Unauthenticated Order Status Manipulation in Nexi XPay WordPress Plugin

Executive Summary

The Nexi XPay Build WordPress plugin through version 7.6.2 has a flaw where it does not properly validate security tokens on its payment notification route. This allows unauthenticated attackers to manipulate order statuses by marking arbitrary orders as paid or changing genuinely paid orders to failed without needing authentication.

Useful 0 Not Useful 0

Detection Guidance

Check if the Nexi XPay WordPress plugin versions 7.2.2 to 7.6.2 are installed. Look for suspicious order status changes without authentication or failed payments on orders that were previously marked as paid.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to financial losses if attackers mark unpaid orders as paid, causing merchants to ship products without receiving payment. Alternatively, attackers could mark paid orders as failed, leading to refund requests and potential disputes.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the Nexi XPay plugin immediately if installed. Monitor order statuses for unauthorized changes. Apply any available patches or updates once released. Consider alternative payment plugins until a fix is available.

Useful 0 Not Useful 0