CVE-2025-15565CWE-862

Nexi XPay <= 8.3.0 - Missing Authorization to Unauthenticated Order Status Modification

Medium · published April 14, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
8.1
In the wild
Unconfirmed
What it is

The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the redirect function in all versions up to, and including, 8.3.0. This makes it possible for unauthenticated attackers to mark pending WooCommerce orders as paid/completed.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00189 · 8.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-04-14T21:26Z
EPSS history
Timeline
  • 14 APR 21:26Z
    Nexi XPay <= 8.3.0 - Missing Authorization to Unauthenticated Order Status Modification
    cvelistv5