What is the CVSS score of CVE-2026-9702?

CVE-2026-9702 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of InPost PL are affected by CVE-2026-9702?

The InPost PL WooCommerce plugin (versions before 1.9.1) allows unauthenticated attackers to redirect customer orders to arbitrary parcel lockers, enabling order interception and parcel theft.. A patch is available.

Is there a public PoC exploit available for CVE-2026-9702?

Yes, a public proof-of-concept exploit is available for CVE-2026-9702. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-9702?

Within 24 hours: Audit all pending and processing orders for unexpected shipping-destination changes, prioritizing high-value shipments. Within 7 days: Update InPost PL WooCommerce plugin to version 1.9.1 or later across all production environments. Within 30 days: Implement transaction logging for shipping-address modifications and configure alerts for orders changed outside buyer-initiated actions.

InPost PL CVE-2026-9702

EUVD-2026-39188 HIGH

2026-06-25 WPScan

GHSA-m6v8-34fj-w7jx

WordPress Information Disclosure Inpost Pl Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Remote, unauthenticated, no interaction (AV:N/AC:L/PR:N/UI:N); impact is integrity-only order-data tampering (I:H), with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 13:23 vuln.today

CVSS changed

Jun 25, 2026 - 13:22 NVD

7.5 (HIGH)

Patch available

Jun 25, 2026 - 08:01 EUVD

CVE Published

Jun 25, 2026 - 06:00 cve.org

HIGH 7.5

CVE Published

Jun 25, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.

Articles & Coverage 1

News 7 New WordPress Vulnerabilities - 1 Critical, 6 High, 2 With POC Jun 26, 2026

AnalysisAI

Order shipping-destination tampering in the InPost PL WooCommerce plugin (versions before 1.9.1) lets unauthenticated remote attackers silently change the parcel-locker delivery point of any order still in 'pending' or 'processing' status, because the plugin never verifies the request comes from the legitimate buyer. Publicly available exploit code exists and a vendor patch has been released, though this is not listed in CISA KEV (no public exploit identified as actively exploited at time of analysis beyond the published POC). With CVSS 7.5 and an integrity-only impact, the practical risk is shipment redirection / parcel theft rather than data disclosure.

Technical ContextAI

The plugin integrates InPost's Polish parcel-locker (Paczkomat) network into WooCommerce, exposing an endpoint to set or update an order's locker destination. The flaw is a broken access-control / missing-authorization class issue (effectively CWE-862 Missing Authorization combined with CWE-352 CSRF-style missing origin verification; NVD lists no CWE). The handler that updates the parcel-locker destination trusts the incoming request without confirming the requester owns the order (no nonce, capability, or buyer-identity check), so any party who can reference an order can mutate its delivery target. The 'Information Disclosure' tag in the source feed is misleading: the CVSS vector (C:N/I:H/A:N) shows the impact is integrity (order data tampering), not confidentiality.

RemediationAI

Update the InPost PL plugin to version 1.9.1 or later (Vendor-released patch: 1.9.1), which adds verification that destination-update requests originate from the legitimate buyer. Administrators should apply this through the WordPress plugin updater and confirm the active version is >= 1.9.1. If immediate patching is not possible, compensating controls include temporarily deactivating the InPost PL plugin (trade-off: customers lose parcel-locker selection at checkout), placing the WooCommerce checkout/AJAX endpoints behind a WAF rule that requires a valid session/nonce for order-modification requests (trade-off: may block legitimate guest flows if too strict), and monitoring/alerting on parcel-locker destination changes for pending and processing orders so any tampering can be caught and reversed before fulfillment. Reference advisories: https://wpscan.com/vulnerability/79b27813-3d75-46a3-98d3-e6d8eb8ad467/ and https://nvd.nist.gov/vuln/detail/CVE-2026-9702.