Nexi XPay WordPress Plugin Missing Authorization Vulnerability Allows Unauthenticated Order Status Modification

A vulnerability exists in the Nexi XPay plugin for WordPress, all versions through 8.3.0, due to inadequate authorization checks in the redirect function. This flaw enables unauthenticated attackers to alter the status of pending WooCommerce orders, marking them as paid or completed.

Impact

Exploitation of this vulnerability allows for unauthorized modification of WooCommerce order statuses, potentially leading to financial discrepancies and unauthorized order completions.

Remediation

Users are advised to update the Nexi XPay WordPress plugin to version 8.3.2 or a newer patched version.