What is the CVSS score of EUVD-2025-209461?

EUVD-2025-209461 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress EUVD-2025-209461

| CVE-2025-15565 MEDIUM

Missing Authorization (CWE-862)

2026-04-14 security@wordfence.com

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 22:43 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 22:22 euvd

EUVD-2025-209461

Analysis Generated

Apr 14, 2026 - 22:22 vuln.today

CVE Published

Apr 14, 2026 - 22:16 nvd

MEDIUM 5.3

DescriptionCVE.org

The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the redirect function in all versions up to, and including, 8.3.0. This makes it possible for unauthenticated attackers to mark pending WooCommerce orders as paid/completed.

AnalysisAI

Unauthenticated attackers can bypass authorization checks in the Nexi XPay plugin for WordPress (versions up to 8.3.0) to mark pending WooCommerce orders as paid or completed by exploiting a missing authorization check on the redirect function. This allows payment fraud by converting unpaid orders into completed transactions without authentication. No public exploit code or active exploitation has been reported at time of analysis.

Technical ContextAI

The Nexi XPay plugin integrates payment processing with WooCommerce, handling order completion callbacks through a redirect function in the WC_Gateway_XPay_Process_Completion class. The vulnerability stems from CWE-862 (Missing Authorization), where the redirect endpoint that triggers order status updates fails to verify user privileges or request legitimacy before processing payment completion callbacks. This is a common flaw in payment gateway plugins where callback handlers should validate webhook signatures, nonces, or authenticated sessions before modifying order state, but the XPay implementation skips these checks entirely. The affected code exists in the WooCommerce Gateway XPay plugin (CPE context: WordPress plugin ecosystem) across all versions through 8.3.0.

RemediationAI

Upgrade the Nexi XPay plugin to version 8.3.1 or later, which includes authorization checks on the redirect function. Site administrators should immediately update via the WordPress Plugins dashboard or manually download the patched version from the WordPress plugin repository. Until patched, implement temporary mitigations by disabling the XPay payment gateway on the storefront and using an alternative payment processor, or by implementing Web Application Firewall (WAF) rules to block unauthorized requests to the vulnerable redirect endpoint (monitor for requests from non-authenticated sessions to the XPay callback handler). For detailed patch information and verification of the fix, consult the official Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f420151b-c783-49b1-b0e9-e936a904278a.