CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the redirect function in all versions up to, and including, 8.3.0. This makes it possible for unauthenticated attackers to mark pending WooCommerce orders as paid/completed.
Explanation of Vulnerability in Simple Terms
Nexi XPay versions 8.3.0 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify data through the network. The vulnerability does not expose sensitive information or disrupt service availability, but attackers can alter records without authentication or user interaction required.
What an attacker can do
Modify data in the payment system without authentication.
Potential impact on your site
Attackers can alter payment records, transaction data, or configuration without logging in.
Conditions required to exploit
Network access to the Nexi XPay application; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
