Skip to content
Sign in
7.5 High

CVE-2026-9702 The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before…

Description

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.

Affected products and versions

Product Affected versions Fixed in
InPost PL 1.9 earliest → < 1.9.1 1.9.1

Other CVEs of InPost PL

The 2 CVEs of InPost PL →
CVE-2026-93580 The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests,… 5.3 Medium
Track this CVE