CVE-2026-16981

MediumCVSS 5.3/10Last modified Aug 26, 2026

Description

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored shipping label, each containing the customer's full name, complete postal address, and order reference.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Aug 5, 2026
Last modified
Aug 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-169827.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.CVE-2026-169834.3The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintCVE-2026-169846.5The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not iCVE-2026-169858.8The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its atCVE-2026-169865.3The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriviCVE-2026-169877.8IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment varCVE-2026-169887.5The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requeCVE-2026-169897.8IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper resolution of symboliCVE-2026-16998.8In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while chCVE-2026-169905.3The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a clieCVE-2026-169917.8IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper handling of symbolic CVE-2026-169926.5The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, a