CVE-2026-9702 — InPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking
The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination…
Published: 2026-06-25 · CVSS: 7.5 · CVSS 3.1
The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7