Hello,

The folder http://YOUR-PRESTA/modules/bpostshm/pdf/ is not protected. It contains all generated stickers with addresses of clients.

You should at least add an empty index.php file in the folder, but even then the filename structure is pretty easy to guess. Filenames should be obfuscated or every query should be checked against credentials (using .htaccess?).