7.5
Élevée
CVE-2026-9702 The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before…
Description
The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| InPost PL 1.9 | premières → < 1.9.1 | 1.9.1 |