CVE-2025-15565
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Nexi XPay plugin for WordPress versions up to 8.3.0 contains an unauthorized data modification vulnerability due to missing authorization checks on the redirect function. This allows unauthenticated attackers to mark pending WooCommerce orders as paid/completed.
Risk Assessment
Attackers can falsify payment statuses, potentially leading to shipment of goods without actual payment, financial losses, and order data integrity breaches.
Recommendation
Immediately update the Nexi XPay plugin to the latest version and implement additional authorization checks for the redirect function.
Original NVD description (English source)
The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the redirect function in all versions up to, and including, 8.3.0. This makes it possible for unauthenticated attackers to mark pending WooCommerce orders as paid/completed.