InPost PL EUVD-2026-89623

Exploitable by a remote unauthenticated attacker against the InPost PL plugin's shipment webhook handler in versions 1.7.5 through before 1.9.8, but ONLY when the attacker knows the specific parcel tracking number of the target order. The plugin authenticates incoming webhooks solely via a non-secret identifier plus an IP allowlist that is not actually enforced, so no credentials, user interaction, or non-default configuration are needed beyond the plugin being installed and reachable. The primary limiting factor is knowledge of a valid target order's tracking number, which scopes practical abuse toward specific known orders rather than untargeted mass exploitation; impact is limited to order-status integrity (marking orders completed), with no data disclosure or service disruption.

This is a genuine but low-severity access-control flaw (CWE-862) whose signals are internally consistent and point away from urgent, widespread exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3 MEDIUM) reflects an unauthenticated, network-reachable integrity-only issue with no confidentiality or availability impact, which matches the description: an attacker forges a shipment webhook to prematurely mark an order 'completed'. CISA SSVC reinforces the modest priority - Exploitation: none (no observed activity), Automatable: yes (the endpoint is unauthenticated and scriptable), Technical Impact: partial (integrity only, not total control). There is no EPSS score in the input, no CISA KEV listing, and no public proof-of-concept referenced, so exploitation status is 'no public exploit identified at time of analysis.' The practical limiter is meaningful: the attacker must KNOW a specific target order's parcel tracking number, which is not a secret cryptographic value but is also not trivially enumerable at scale, making this better suited to targeted fraud (e.g., triggering order-completion/fulfilment or refund workflows on a known order) than mass automated abuse. Net: a real, patch-worthy business-logic weakness for InPost merchants, but low real-world urgency given integrity-only impact, niche regional footprint, and no evidence of exploitation.

An attacker who has obtained a victim order's InPost parcel tracking number (e.g., from a phishing lure, intercepted email, or a placed test order) sends a forged shipment-status webhook to the store's public InPost PL endpoint. Because the plugin only checks a non-secret identifier and an IP restriction that is not enforced, the request is accepted and the order is prematurely marked 'completed', potentially triggering downstream fulfilment, digital-goods delivery, or refund/return logic. No public POC is referenced, but the flaw is automatable and requires no authentication.