CVE-2026-9702

InPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking

High · published June 25, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
28.3
In the wild
Unconfirmed
What it is

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00358 · 28.3th percentile
Published
2026-06-25T06:00Z
EPSS history
Timeline
  • 25 JUN 06:00Z
    InPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking
    cvelistv5