Threats tagged 'ghsa-q7cc-q448-hh85'

CVE-2026-16993 is an information exposure vulnerability in the DHL Shipping Germany for WooCommerce WordPress plugin versions before 4.0.1. The plugin stores shipping labels containing customer names and postal addresses in a directory protected only by an Apache .htaccess file. On web servers that do not honor .htaccess files, such as nginx, unauthenticated attackers can download these shipping labels by requesting predictable filenames. This vulnerability leads to unauthorized disclosure of customer shipping information.