EUVD-2025-209461
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the redirect function in all versions up to, and including, 8.3.0. This makes it possible for unauthenticated attackers to mark pending WooCommerce orders as paid/completed.
AnalysisAI
Unauthenticated attackers can bypass authorization checks in the Nexi XPay plugin for WordPress (versions up to 8.3.0) to mark pending WooCommerce orders as paid or completed by exploiting a missing authorization check on the redirect function. This allows payment fraud by converting unpaid orders into completed transactions without authentication. No public exploit code or active exploitation has been reported at time of analysis.
Technical ContextAI
The Nexi XPay plugin integrates payment processing with WooCommerce, handling order completion callbacks through a redirect function in the WC_Gateway_XPay_Process_Completion class. The vulnerability stems from CWE-862 (Missing Authorization), where the redirect endpoint that triggers order status updates fails to verify user privileges or request legitimacy before processing payment completion callbacks. This is a common flaw in payment gateway plugins where callback handlers should validate webhook signatures, nonces, or authenticated sessions before modifying order state, but the XPay implementation skips these checks entirely. The affected code exists in the WooCommerce Gateway XPay plugin (CPE context: WordPress plugin ecosystem) across all versions through 8.3.0.
RemediationAI
Upgrade the Nexi XPay plugin to version 8.3.1 or later, which includes authorization checks on the redirect function. Site administrators should immediately update via the WordPress Plugins dashboard or manually download the patched version from the WordPress plugin repository. Until patched, implement temporary mitigations by disabling the XPay payment gateway on the storefront and using an alternative payment processor, or by implementing Web Application Firewall (WAF) rules to block unauthorized requests to the vulnerable redirect endpoint (monitor for requests from non-authenticated sessions to the XPay callback handler). For detailed patch information and verification of the fix, consult the official Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f420151b-c783-49b1-b0e9-e936a904278a.
Share
External POC / Exploit Code
Leaving vuln.today