PT-2026-56788 · Dhlparcel · Dhl Ecommerce (Benelux) For Woocommerce

Muhan Luo · Published 2026-07-09 · Updated 2026-07-09 · CVE-2026-9235

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

The DHL eCommerce (Benelux) for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check and missing nonce verification on the create label() and delete label() functions in versions up to, and including, 2.2.3. These functions are wired to the wp ajax dhlpwc label create and wp ajax dhlpwc label delete hooks and act on an attacker-supplied post id (WooCommerce order ID). This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or delete DHL shipping labels associated with any WooCommerce order on the site.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-9235

Affected Products

Dhl Ecommerce (Benelux) For Woocommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-9235 · Security Note
• https://plugins.trac.wordpress.org/browser/dhlpwc/tags/2.2.3/includes/controller/admin/class-dhlpwc-controller-admin-order-metabox.php#L164 · Note
• https://plugins.trac.wordpress.org/browser/dhlpwc/tags/2.2.3/includes/controller/admin/class-dhlpwc-controller-admin-order-metabox.php#L117 · Note
• https://plugins.trac.wordpress.org/browser/dhlpwc/tags/2.2.3/includes/controller/admin/class-dhlpwc-controller-admin-order-metabox.php#L25 · Note
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3575375%40dhlpwc&new=3575375%40dhlpwc · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b5e0af52-3e38-4ff4-b53c-c7c35f1b956a?source=cve · Note