CVE-2026-9702

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.

Score

CVSS 3.1 7.5 High

Status

Deferred - contact@wpscan.com

Published

2026-06-25

Last modified

2026-06-25

Affected products

• Inpost Pl (Unknown)

References

• https://wpscan.com/vulnerability/79b27813-3d75-46a3-98d3-e6d8eb8ad467/