The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
The InPost PL WordPress plugin vulnerability is a critical authorization bypass flaw affecting WooCommerce-powered e-commerce sites. Versions before 1.9.1 lack proper request validation when updating parcel-locker shipping destinations, allowing unauthenticated attackers to silently redirect orders to attacker-controlled locations. This vulnerability directly impacts any WooCommerce merchant using the InPost plugin—particularly businesses in Poland and Europe where InPost is prevalent. Attackers can intercept orders in pending or processing states, changing delivery addresses without customer or merchant notification, leading to order theft, inventory loss, and significant reputational damage.
While this CVE does not map to documented MITRE ATT&CK techniques in the initial submission, Casky's security skills powered by Claude AI would detect the underlying attack patterns associated with Privilege Escalation (T1078 - Use of Legitimate Credentials) and Collection (T1113 - Screen Capture) through behavioral analysis of unauthorized state changes. A practitioner would observe anomalous API requests modifying order metadata without corresponding authentication tokens, unusual shipping address changes correlating with request patterns, and gaps in audit logs for order modifications. Casky's extended reasoning would identify the missing server-side request origin validation as the critical control failure and recommend implementing CSRF tokens, nonce verification, and strict authentication checks before allowing any order modifications—standard defensive measures that map to secure coding practices within the platform's skill taxonomy.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-9702. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation