Technical impact
The nexi Alpha Bank for WooCommerce plugin up to version 2.2.0 does not enforce the presence of a shared secret when processing the bank’s payment‑notification callback. An attacker who can reach the callback endpoint can send an empty shared‑secret value and receive authentication, allowing the attacker to forge a valid payment confirmation. The forged notification marks any WooCommerce order as paid without the actual payment having taken place. In addition, the plugin’s callback can also transition any pending order to a failed state regardless of whether a secret is configured, compounding the impact. This flaw results in a full breach of the payment flow integrity, granting an unauthenticated attacker control over order status and potential financial loss.
Affected Systems
This vulnerability affects installations of the nexi Alpha Bank for WooCommerce WordPress plugin with version 2.2.0 or earlier. The plugin is used as a payment gateway for WooCommerce sites, and the vendor information is not publicly disclosed.
Risk and Exploitability
The EPSS score of <1% indicates a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV. The CVSS score for this vulnerability is 5.3, indicating moderate severity. An attacker who can trigger the callback requires only to reach the plugin’s endpoint, which is typically exposed to the public internet. The absence of a shared secret removes the standard authentication barrier, making the exploitation trivial for those with network access to the site, and it is inferred that the attacker must reach the plugin's publicly exposed callback endpoint to exploit this vulnerability.
