CyberRota Analysis
AI-GeneratedThe DHL eCommerce (Benelux) plugin for WooCommerce in WordPress is vulnerable to unauthorized modification and data loss due to inadequate capability checks and nonce verification in its label creation and deletion functions. This flaw allows authenticated users with Subscriber-level access or higher to manipulate DHL shipping labels for any WooCommerce order, potentially leading to significant operational disruptions. WordPress site administrators using this plugin should prioritize patching to mitigate the risk of exploitation.
Original NVD Description
The DHL eCommerce (Benelux) for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check and missing nonce verification on the create_label() and delete_label() functions in versions up to, and including, 2.2.3. These functions are wired to the wp_ajax_dhlpwc_label_create and wp_ajax_dhlpwc_label_delete hooks and act on an attacker-supplied post_id (WooCommerce order ID). This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or delete DHL shipping labels associated with any WooCommerce order on the site.