CVE-2025-15565

BRIEFING NOTE: CVE-2025-15565 The Nexi XPay plugin for WordPress contains a critical authorization bypass vulnerability affecting all versions through 8.3.0. The flaw exists in the redirect function, which lacks proper authentication checks, allowing unauthenticated attackers to manipulate WooCommerce order statuses and fraudulently mark pending orders as paid or completed. This vulnerability presents a medium severity risk with a CVSS score of 5.3. The attack requires no special privileges or user interaction and can be executed remotely over the network. While the confidentiality impact is minimal, the integrity impact is significant as attackers can directly modify order payment statuses in WooCommerce installations, potentially leading to order fulfillment fraud and financial loss. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities catalog and remains inactive on security hotlists. The EPSS score of 0.0005 indicates very low likelihood of exploitation in the immediate future. However, organizations using this plugin should prioritize patching given the straightforward nature of the attack and the direct financial implications of order status manipulation.