Nexi Xpay Build
Monthly
Unauthenticated attackers can forge payment-notification callbacks to the Nexi XPay Build WordPress plugin (through version 7.6.2) and mark arbitrary WooCommerce orders as paid - or downgrade genuinely paid orders to a failed status - because the plugin skips its security-token comparison whenever the targeted order has no stored token. The issue is remotely reachable at low complexity with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5), and the impact is purely integrity-based: no confidentiality loss, but direct tampering with order and payment state on the store. Publicly available exploit code exists; however, no CISA KEV listing or other confirmation of active exploitation is present in the supplied intelligence, and exploitation is constrained to orders that happen to be in the tokenless condition.
Unauthenticated payment-result forgery in the Nexi XPay Build WordPress plugin through 7.6.2 lets any remote attacker mark arbitrary orders as paid or failed, cancel those orders at will, and retrieve the order keys that unlock guest buyers' personal details. The vulnerable surface is the plugin's payment-result handling routes, which accept a supplied payment result without verifying it, so no credentials, user interaction, or non-default configuration are needed beyond a site running the plugin as an active Nexi XPay gateway. Publicly available exploit code exists via the WPScan advisory, and although there is no confirmed active exploitation (not listed in CISA KEV), the high integrity impact on order state and the exposure of guest customer data make this an actionable priority; exploitation is limited in practice only by the narrow installed base of this specific gateway plugin.
Unauthenticated attackers can forge payment-notification callbacks to the Nexi XPay Build WordPress plugin (through version 7.6.2) and mark arbitrary WooCommerce orders as paid - or downgrade genuinely paid orders to a failed status - because the plugin skips its security-token comparison whenever the targeted order has no stored token. The issue is remotely reachable at low complexity with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5), and the impact is purely integrity-based: no confidentiality loss, but direct tampering with order and payment state on the store. Publicly available exploit code exists; however, no CISA KEV listing or other confirmation of active exploitation is present in the supplied intelligence, and exploitation is constrained to orders that happen to be in the tokenless condition.
Unauthenticated payment-result forgery in the Nexi XPay Build WordPress plugin through 7.6.2 lets any remote attacker mark arbitrary orders as paid or failed, cancel those orders at will, and retrieve the order keys that unlock guest buyers' personal details. The vulnerable surface is the plugin's payment-result handling routes, which accept a supplied payment result without verifying it, so no credentials, user interaction, or non-default configuration are needed beyond a site running the plugin as an active Nexi XPay gateway. Publicly available exploit code exists via the WPScan advisory, and although there is no confirmed active exploitation (not listed in CISA KEV), the high integrity impact on order state and the exposure of guest customer data make this an actionable priority; exploitation is limited in practice only by the narrow installed base of this specific gateway plugin.