Executive brief
A vulnerability in the InPost PL plugin for WordPress allows unauthorized individuals to change the delivery location of existing customer orders. By exploiting this flaw, an attacker can redirect packages to a different parcel locker without the legitimate buyer's knowledge. This could lead to theft of goods, financial loss for the merchant, and significant damage to customer trust.
Technical details
An improper access control vulnerability exists in the InPost PL plugin (inpost-for-woocommerce) due to a lack of ownership verification in the 'update_locker_from_typ_page' AJAX action. An unauthenticated attacker can obtain a valid security nonce by visiting the checkout page and then issue a crafted POST request to wp-admin/admin-ajax.php. By providing a target 'order_id' and new locker details, the attacker can update the '_parcel_machine_id' meta field for any order in a 'pending' or 'processing' state. This allows for cross-customer order hijacking, as the plugin fails to check if the requester is the original purchaser of the order being modified. The issue is resolved in version 1.9.1.
Affected products
- InPost InPost PL (inpost-for-woocommerce) < 1.9.1
Timeline
- 2026-06-04: disclosed: Publicly published by WPScan
- 2026-06-25: advisory: NVD publication date
- 2026-06-25: patched: Fixed in version 1.9.1