The DHL Shipping Germany for WooCommerce plugin fails to protect its shipping‑label storage directory with server‑independent access control, relying solely on an Apache .htaccess file. On servers that do not honor .htaccess, such as nginx, any unauthenticated user can request predictable filenames and download stored shipping labels. These files contain customers' names and postal addresses, representing a clear disclosure of personally identifiable information.

WordPress sites running the DHL Shipping Germany for WooCommerce plugin version earlier than 4.0.1 are impacted. The vulnerability affects the plugin’s default shipping‑label directory, which is stored in a publicly accessible location.

Because the directory is exposed without authentication, the exploit requires only a simple HTTP GET request to a known filename. No code execution or privilege escalation is involved, but the impact is high due to the sensitive nature of the data. The EPSS score is unavailable and the vulnerability is not listed in CISA KEV, but the absence of server‑level protection and the potential for mass PII leakage make the risk significant, especially on web servers that ignore .htaccess directives.