Technical impact
The Nexi XPay plugin for WordPress contains a missing authorization check on the redirect function in all releases up to 8.3.0. This flaw allows an unauthenticated user to manipulate the order status, turning unapproved or pending orders into paid or completed ones. The impact is that attackers could trigger transactions or claims of receipt for orders they never authorized, possibly resulting in financial loss or refund disputes.
Affected Systems
The vulnerable component is the Nexi XPay WordPress plugin distributed by Cartasi. All versions 8.3.0 and earlier are affected. Users deploying the plugin on any WordPress site that processes WooCommerce orders should verify and update their installation.
Risk and Exploitability
The CVSS score of 5.3 indicates medium severity and highlights an authentication bypass within the application. No EPSS value is provided, suggesting limited data on current exploitation prevalence, and the issue is not in the CISA KEV list. Because no authentication is required, the vulnerability can be exploited over the public web by crafting a request to the redirect endpoint. While no public exploit has been documented, the risk is significant for sites handling sensitive payment data. The absence of a mitigation in the public feed means the exploitation vector remains plausible until a patch is applied.
