CVE-2026-93580 — InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook

CVE-2026-93580

InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook PUBLISHED

Description (CNA)

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipment status and prematurely mark the order completed.

Affected (CNA)

Vendor / product	Versions
Unknown / InPost PL	affected 1.7.5 before 1.9.8

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/083dab74-cffe-4532-8fc3-939a015c83d4/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.