CVE-2026-93580

The InPost PL WordPress plugin (specifically InPost for WooCommerce versions 1.7.5 - 1.9.7 ) is vulnerable to unauthenticated order status forgery. The root cause is a failure to verify the authenticity of incoming shipment webhook requests , as the plugin relies on a non-secret identifier and an...