Description
The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | InPost PL | < 1.9.1 | 1.9.1 |
References
- https://wpscan.com/vulnerability/79b27813-3d75-46a3-98d3-e6d8eb8ad467/ exploit vdb-entry technical-description