CVE-2026-9702: InPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking
The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InPost PL WordPress pluginto a version that resolves this vulnerability.Fixed in 1.9.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9702?
The severity of CVE-2026-9702 is rated as high with a CVSS score of 7.5.
How do I fix CVE-2026-9702?
To fix CVE-2026-9702, update the InPost PL plugin to version 1.9.1 or later.
What impact does CVE-2026-9702 have on my website?
CVE-2026-9702 allows unauthenticated attackers to redirect WooCommerce order shipping destinations without verification.
Is CVE-2026-9702 exploitable remotely?
Yes, CVE-2026-9702 can be exploited remotely as it does not require authentication.
What versions of the InPost PL plugin are affected by CVE-2026-9702?
All versions of the InPost PL plugin prior to 1.9.1 are affected by CVE-2026-9702.