CVE-2026-9235

The DHL eCommerce (Benelux) for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check and missing nonce verification on the create_label() and delete_label() functions in versions up to, and including, 2.2.3. These functions are wired to the wp_ajax_dhlpwc_label_create and wp_ajax_dhlpwc_label_delete hooks and act on an attacker-supplied post_id (WooCommerce order ID). This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or delete DHL shipping labels associated with any WooCommerce order on the site.

• CWE-862

• https://plugins.trac.wordpress.org/browser/dhlpwc/tags/2.2.3/includes/controller/admin/class-dhlpwc-controller-admin-order-metabox.php#L117
• https://plugins.trac.wordpress.org/browser/dhlpwc/tags/2.2.3/includes/controller/admin/class-dhlpwc-controller-admin-order-metabox.php#L164
• https://plugins.trac.wordpress.org/browser/dhlpwc/tags/2.2.3/includes/controller/admin/class-dhlpwc-controller-admin-order-metabox.php#L25
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3575375%40dhlpwc&new=3575375%40dhlpwc
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b5e0af52-3e38-4ff4-b53c-c7c35f1b956a?source=cve

Published

Jul 9, 2026

Last Modified

Jul 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9224Missing authorization in the user profile update feature in …4.3
• CVE-2026-9227The GutenBee – Gutenberg Blocks plugin for WordPress is vuln…8.8
• CVE-2026-9228The Timetable and Event Schedule by MotoPress plugin for Wor…4.3
• CVE-2026-9230The Quiz and Survey Master (QSM) – Easy Quiz and Survey Make…4.3
• CVE-2026-9233The Quiz and Survey Master (QSM) – Easy Quiz and Survey Make…4.3
• CVE-2026-9234The JTL-Connector for WooCommerce plugin for WordPress is vu…4.3
• CVE-2026-9236The CM Ad Changer – A simple tool to control and optimize yo…4.3
• CVE-2026-9237The Employee, Leave and Recruitment Management System – Crew…4.3
• CVE-2026-9240The Colissimo Officiel : Méthodes de livraison pour WooComme…4.3
• CVE-2026-9241The FOX – Currency Switcher Professional for WooCommerce plu…4.3
• CVE-2026-9242The RegistrationMagic – Custom Registration Forms, User Regi…5.3
• CVE-2026-9243The Plus Addons for Elementor plugin for WordPress is vulner…6.4