CVE-2026-9702 is an improper access control vulnerability (CWE-284) in the InPost PL WordPress plugin prior to version 1.9.1. The plugin fails to verify that requests to update the WooCommerce order parcel-locker destination come from the legitimate buyer. As a result, unauthenticated attackers can silently redirect the shipping destination of any pending or processing order on the affected site. There is no CVSS score or vendor advisory indicating a patch or fix, and no known exploits in the wild have been reported.

An attacker can manipulate the shipping destination of orders without authentication, potentially redirecting goods to unauthorized locations. This could lead to loss of merchandise and financial impact for merchants using the affected plugin versions. The vulnerability affects order integrity and trust in the e-commerce process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's order management functions and monitor for suspicious activity related to order destination changes.