Unauthorized Data Modification in Nexi XPay Plugin for WordPress

CVE-2025-15565

What is CVE-2025-15565?

The Nexi XPay plugin for WordPress suffers from a significant vulnerability due to the absence of necessary authorization checks in its redirect functionality. This flaw allows unauthenticated attackers to manipulate WooCommerce order statuses, enabling them to mark pending orders as paid or completed. Such exploitation can lead to financial losses and compromise the integrity of online transactions, thereby posing serious risks to both merchants and customers.

References