InPost PL EUVD-2026-39188

Exploitation requires the target WooCommerce site to run the InPost PL plugin at a version below 1.9.1 with the parcel-locker destination feature in use, and a victim order that is in 'pending' or 'processing' status (already-shipped/completed orders are out of scope). The attacker must be able to reference/target the order whose destination is changed. Limiting factors: only mutable order states are affected, value is realized only if the merchant ships before noticing the altered destination, and the plugin's deployment is concentrated among Polish InPost/Paczkomat merchants rather than the general WordPress population. No authentication and no user interaction are required (PR:N/UI:N), so against an unpatched, in-use installation there are no further access prerequisites.

Signals are largely consistent toward a genuine but bounded threat. The CVSS vector AV:N/AC:L/PR:N/UI:N is fully remote, unauthenticated, low-complexity with no user interaction, and a public POC from WPScan exists - a low exploitation bar. However, impact is integrity-only (C:N/I:H/A:N): an attacker alters shipping destinations but does not read data, gain code execution, or take the site down, which correctly caps severity at 7.5 rather than critical. No EPSS score was provided in the input, and the issue is not in CISA KEV, so there is no evidence of widespread active exploitation - only the published POC. The realistic limiter is that exploitation only affects orders in 'pending' or 'processing' state and the attacker must be able to target/enumerate order identifiers; combined with the plugin's narrow, Poland-specific deployment footprint, this is a real priority for the affected merchant population but not a broad internet-scale event.

An attacker enumerates or references an order ID on a WooCommerce store running InPost PL and, without logging in, sends a crafted request that updates the order's parcel-locker destination to a locker the attacker controls. Because no buyer-identity or origin check is performed, the change is accepted silently; when the merchant fulfills the still-pending order, the physical goods are routed to the attacker's pickup point. A public POC from WPScan demonstrates the low-complexity, unauthenticated request.