The DHL eCommerce (Benelux) for WooCommerce plugin for WordPress is vulnerable because the create_label() and delete_label() functions lack proper capability checks and nonce verification. As a result, any authenticated user with Subscriber-level access or higher can submit arbitrary WooCommerce order IDs to the wp-admin/admin-ajax.php endpoints ‘dhlpwc_label_create’ and ‘dhlpwc_label_delete’. This allows an attacker to create or delete DHL shipping labels for any order on the site, potentially causing incorrect or fraudulent shipments and financial loss. The flaw requires only a valid WordPress account and does not involve code execution or elevated privileges.

WordPress sites that have installed the DHL eCommerce (Benelux) for WooCommerce plugin, version 2.2.3 or earlier. The vulnerability affects all users with Subscriber permissions or higher on those sites, as they can exercise the label actions via the exposed AJAX hooks.

The CVSS score of 4.3 classifies the vulnerability as low-to-medium severity, while the EPSS score of less than 1% indicates a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires only a legitimate WordPress account with Subscriber-level access; no further privileges or code execution are necessary. Once an attacker has such credentials, they can craft requests to wp-admin/admin-ajax.php to create or delete labels for any order, making the attack trivial from a technical perspective but requiring no special access.