Executive brief
The Nexi XPay plugin for WordPress, which handles credit card payments for online stores, contains a security flaw in how it processes payment redirects. This vulnerability allows unauthorized individuals to bypass the payment process and falsely mark pending orders as paid or completed. This could lead to financial loss for merchants who fulfill orders that have not actually been funded.
Technical details
The Nexi XPay plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) within its redirect handling logic. Specifically, the 'redirect' function in the WC_Gateway_XPay_Process_Completion class fails to validate the authenticity or authorization of the request before updating order statuses. An unauthenticated remote attacker can exploit this by sending a crafted request to the vulnerable endpoint, causing the plugin to transition WooCommerce orders from 'pending' to 'processing' or 'completed' without a valid payment confirmation. This affects all versions of the plugin up to and including 8.3.0.
Affected products
- Nexi (Cartasi) Nexi XPay up to, and including, 8.3.0
Timeline
- 2026-04-14: disclosed: Initial publication of the vulnerability advisory.
- 2026-04-14: advisory: Wordfence published the vulnerability details.