CVE-2026-93580: InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook
The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipment status and prematurely mark the order completed.
Affected Software
Event History
Frequently Asked Questions
Which stores are exposed to this issue?
Stores using the InPost PL WordPress plugin in versions before 1.9.8 are affected. An exposed store must accept shipment webhook requests for its orders.
What does an attacker need to exploit it?
The attacker needs the parcel tracking number for a target order. No authentication is required for the forged shipment webhook request.
What is the practical impact of a successful attack?
An attacker can forge a shipment status update and cause the targeted order to be marked completed prematurely.
Does the plugin's IP check prevent exploitation?
No. The described IP check is not enforced, and the webhook identifier is not secret, so it does not authenticate incoming webhook requests.
What should be done if immediate patching is not possible?
The provided information does not specify a workaround. Prioritize preventing untrusted access to the shipment webhook endpoint and monitor orders for unexpected shipment-status changes until the plugin can be updated to 1.9.8 or later.