CVE-2026-9235 is a missing authorization vulnerability (CWE-862) in the DHL eCommerce (Benelux) for WooCommerce plugin for WordPress. The create_label() and delete_label() functions, triggered via wp_ajax_dhlpwc_label_create and wp_ajax_dhlpwc_label_delete hooks, lack proper capability checks and nonce verification. This allows authenticated users with Subscriber-level privileges or higher to manipulate DHL shipping labels associated with any WooCommerce order by supplying arbitrary post IDs. The vulnerability affects versions up to and including 2.2.3. No official patch or remediation level is currently stated, and no known exploits are reported in the wild.

The vulnerability permits unauthorized modification of DHL shipping labels linked to WooCommerce orders by authenticated users with low-level privileges (Subscriber and above). This can lead to loss or alteration of shipping label data but does not disclose sensitive information or cause denial of service. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low attack complexity but limited impact on confidentiality and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted individuals only and monitor for suspicious activity related to label creation and deletion. Avoid granting Subscriber-level or higher access to untrusted users. Implement custom capability checks or nonce verification in the affected AJAX handlers if possible.