Security Alert Summary
The Nexi XPay plugin for WordPress contains a vulnerability that allows unauthenticated attackers to modify order data due to missing authorization checks on a redirect function. An attacker could mark pending WooCommerce orders as paid or completed without authenticating.
CVE Details
- CVE ID: CVE-2025-15565
- Affected component: Nexi XPay plugin for WordPress
- Affected versions: All versions up to and including 8.3.0
- Published: April 14, 2026 at 10:16:27 PM UTC
- Last modified: April 14, 2026 at 10:16:27 PM UTC
- CVSS v3.1: Base score 5.3, MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: Privileges Required: NONE; User Interaction: NONE; Attack Vector: NETWORK; Attack Complexity: LOW
- Primary impact: Confidentiality: NONE; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-862
Technical Details
The plugin fails to perform proper authorization checks on a redirect function used during order processing. According to the provided information, the missing checks are present in the completion/redirect handling code (referenced in the file path for the gateway process completion code). Because the authorization step is omitted, unauthenticated requests can trigger the same flow that marks WooCommerce orders as paid or completed.
The direct impact is limited to order state modification: an attacker who can invoke the redirect functionality can change the status of pending orders to paid/completed. The weakness stems from a missing server-side authorization check (CWE-862) rather than from a privilege escalation or information disclosure vector.
How This Could Impact Your Website
Consider a typical small business WordPress site using WooCommerce with multiple users: a site owner who manages payments and shipping, internal staff who fulfill orders, and an external contractor who manages storefront content. If an attacker marks unpaid orders as completed, staff may fulfil or ship items that were never paid for, leading to financial loss and operational confusion. Order status manipulation can also complicate accounting records and refund processing.
Even though the vulnerability does not indicate direct disclosure of user credentials or private data, manipulated order states can increase the risk of targeted phishing or social engineering against staff or customers (for example, fake payment confirmations or shipment notifications). If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other non-administrative accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and order logs for unusual behavior, such as unexpected status changes or IP addresses initiating order updates.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
