Skip to content
Sign in
5.3 Medium

CVE-2026-93580 The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests,…

Description

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipment status and prematurely mark the order completed.

Affected products and versions

Product Affected versions Fixed in
InPost PL 1.7 1.7.5 → < 1.9.8 1.9.8

Other CVEs of InPost PL

The 2 CVEs of InPost PL →
CVE-2026-9702 The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before… 7.5 High
Track this CVE