BaseFortify

Executive Summary

The Nexi XPay Build WordPress plugin through version 7.6.2 has a flaw where it does not properly validate security tokens on its payment notification route. This allows unauthenticated attackers to manipulate order statuses by marking arbitrary orders as paid or changing genuinely paid orders to failed without needing authentication.

Useful 0 Not Useful 0

Detection Guidance

Check if the Nexi XPay WordPress plugin versions 7.2.2 to 7.6.2 are installed. Look for suspicious order status changes without authentication or failed payments on orders that were previously marked as paid.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to financial losses if attackers mark unpaid orders as paid, causing merchants to ship products without receiving payment. Alternatively, attackers could mark paid orders as failed, leading to refund requests and potential disputes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized changes to payment statuses. Unauthenticated attackers could mark orders as paid or failed without proper authentication, which may lead to incorrect financial records or unauthorized access to sensitive payment data. This undermines data integrity and security controls required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the Nexi XPay plugin immediately if installed. Monitor order statuses for unauthorized changes. Apply any available patches or updates once released. Consider alternative payment plugins until a fix is available.

Useful 0 Not Useful 0