The InPost PL WordPress plugin prior to version 1.9.1 allows an unauthenticated attacker to update the WooCommerce order parcel-locker destination for any pending or processing order. This flaw means that a malicious user can silently change where a package will be shipped, potentially causing delivery to the wrong address or to an attacker-controlled location. The attack does not require authentication or privileged accounts, leading to a loss of customer trust and possible financial loss due to misdirected shipments.

WordPress sites using the InPost PL plugin with a version earlier than 1.9.1 are affected. The vulnerability exists in the plugin’s endpoint that processes parcel‑locker updates and does not validate the request origin or the user’s permissions. Any site that enables WooCommerce orders with the InPost plugin is at risk unless the plugin is upgraded to 1.9.1 or later.

The flaw can be exploited remotely simply by accessing the order update endpoint, as it does not require authentication. While no CVSS score is published, the impact on delivery logistics and potential financial damage would be considered high. The EPSS score is not listed and the vulnerability is not in the CISA KEV catalog, but the lack of defensive checks makes it highly likely that attackers could find and use the vulnerability in the wild.