PT-2026-56788 · Dhlparcel · Dhl Ecommerce (Benelux) For Woocommerce

Muhan Luo · Publicado 2026-07-09 · Atualizado 2026-07-09 · CVE-2026-9235

NVD

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

The DHL eCommerce (Benelux) for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check and missing nonce verification on the create label() and delete label() functions in versions up to, and including, 2.2.3. These functions are wired to the wp ajax dhlpwc label create and wp ajax dhlpwc label delete hooks and act on an attacker-supplied post id (WooCommerce order ID). This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or delete DHL shipping labels associated with any WooCommerce order on the site.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-9235

Produtos afetados

Dhl Ecommerce (Benelux) For Woocommerce

Referências · 6

• https://plugins.trac.wordpress.org/browser/dhlpwc/tags/2.2.3/includes/controller/admin/class-dhlpwc-controller-admin-order-metabox.php#L164 · Nota
• https://plugins.trac.wordpress.org/browser/dhlpwc/tags/2.2.3/includes/controller/admin/class-dhlpwc-controller-admin-order-metabox.php#L117 · Nota
• https://plugins.trac.wordpress.org/browser/dhlpwc/tags/2.2.3/includes/controller/admin/class-dhlpwc-controller-admin-order-metabox.php#L25 · Nota
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3575375%40dhlpwc&new=3575375%40dhlpwc · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/b5e0af52-3e38-4ff4-b53c-c7c35f1b956a?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-9235 · Nota de Segurança