PT-2026-32918 · WordPress · Nexi Xpay

Published 2026-04-14 · Updated 2026-04-15 · CVE-2025-15565

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nexi XPay versions prior to 8.3.1

Description The Nexi XPay plugin for WordPress contains a flaw allowing unauthorized modification of data. This is caused by missing authorization checks in the redirect function, which enables unauthenticated attackers to mark pending WooCommerce orders as paid or completed.

Recommendations Update the plugin to a version later than 8.3.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-15565

Affected Products

Nexi Xpay

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-15565 · Security Note
• https://twitter.com/CVEnew/status/2044338920993993022 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f420151b-c783-49b1-b0e9-e936a904278a?source=cve · Note
• https://plugins.trac.wordpress.org/browser/cartasi-x-pay/tags/8.2.0/src/classes/Nexi/WC_Gateway_XPay_Process_Completion.php#L268 · Note