CVE-2026-9702

7.5 highEPSS 0.4%

High (7.5). EPSS 0.4% chance of exploitation in the next 30 days.

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
Published: 2026-06-25
Modified: 2026-06-25
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/79b27813-3d75-46a3-98d3-e6d8eb8ad467/

Check your stack JSON