CVE-2026-9702: InPost PL WordPress Plugin Authentication Bypass – Shipping Redirect

Technical summary

The InPost PL WordPress plugin contains a missing authentication control on the endpoint responsible for updating parcel-locker destinations in WooCommerce orders. The vulnerability stems from insufficient request origin validation; the plugin does not verify that the requester is the legitimate order owner before accepting parcel-locker address modifications. This allows unauthenticated attackers to craft requests that modify the shipping destination of any order in 'pending' or 'processing' state. The issue is classified as an integrity violation (CVSS 3.1 score 7.5, High severity) with a network attack vector and no authentication requirement.

Business impact

E-commerce merchants using affected versions face direct revenue loss through order redirection and goods theft, reputational damage from failed deliveries, and potential liability disputes with customers over missing shipments. The silent nature of the attack—orders appear to process normally in the system but arrive at attacker-controlled locations—complicates detection and customer trust recovery. Supply chain partners and logistics providers may also be impacted by misrouted shipments, straining business relationships.

Affected systems

WordPress installations running the InPost PL plugin in any version before 1.9.1 are vulnerable. The risk is highest for e-commerce sites using WooCommerce with active order fulfillment pipelines. No other vendors or products are referenced in the advisory. Organizations should audit their WordPress plugin inventory to identify affected deployments.

Exploitability

The vulnerability is straightforward to exploit: it requires only network access and basic HTTP request crafting—no authentication, user interaction, or special conditions beyond an order being in a shippable state. An attacker can enumerate orders and systematically redirect shipments. The absence of any prerequisite makes this a practical threat in real-world environments. However, exploitation is not yet tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Upgrade the InPost PL WordPress plugin to version 1.9.1 or later. This version includes the necessary request authentication and origin validation controls. Before upgrading in production, test the plugin update in a staging environment to confirm compatibility with your WooCommerce configuration and any custom order workflows.

Patch guidance

1. Log in to your WordPress admin console. 2. Navigate to Plugins > Installed Plugins. 3. Locate the InPost PL plugin and verify the current version (vulnerable if < 1.9.1). 4. Click 'Update' if available, or deactivate and remove the plugin if no update path exists. 5. After updating, verify that parcel-locker shipping functionality remains operational and that order modification permissions are now enforced. 6. Review recent order history for any unauthorized shipping-destination changes during the vulnerability exposure window. 7. Document the patch date for compliance and audit trails.

Detection guidance

Monitor for suspicious patterns in order management logs, particularly requests that modify parcel-locker destinations from IP addresses or sessions not associated with known customers. Implement request logging on the WooCommerce REST API endpoints related to order shipping updates. Look for repeated modifications to orders in pending/processing state. Correlate shipping-destination changes with login records to identify unauthenticated modifications. Set up alerts for orders where the final parcel-locker address differs significantly from the customer's registered address. Review access logs for the plugin's vulnerable endpoints around the CVE publication date to detect potential historical exploitation.

Why prioritize this

This vulnerability merits immediate priority because it enables direct financial loss with zero barriers to exploitation, affects active order fulfillment, and operates silently without obvious fraud signals. The HIGH CVSS score reflects the combination of network accessibility, lack of authentication, and high integrity impact. Organizations with active WooCommerce stores should treat this as a critical remediation item.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) is driven by: Network attack vector (AV:N) — exploitable remotely with no special network access; Low attack complexity (AC:L) — straightforward exploitation requiring no special conditions; No privileges required (PR:N) — unauthenticated attackers can exploit; No user interaction (UI:N) — completely automated attack possible; High integrity impact (I:H) — attacker can modify order destinations, affecting shipment accuracy and customer deliveries; Confidentiality and availability impacts are not present, as the attacker does not read data or disrupt service availability. The score does not reflect business impact severity, which in an e-commerce context may be higher.

Frequently asked questions