→ برگشت به فید آسیب‌پذیری‌ها CVE-2026-16993 · dhl-for-woocommerce

آسیب‌پذیری امنیتی در افزونه DHL Shipping Germany for WooCommerce

The DHL for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.0.0. This is due to shipping label files stored in a predictable, publicly accessible uploads subdirectory without an unguessable path component, combined with a fallback code path that returned the raw public label_url instead of routing through the protected download endpoint. This makes it possible for unauthenticated attackers to access shipping labels stored in the uploads directory by guessing their predictable public URLs, disclosing sensitive shipment information.