CVE-2025-15565 is a missing authorization vulnerability in the Nexi XPay WordPress plugin (versions up to 8.3.0). The issue arises from the redirect function lacking proper authorization checks, enabling unauthenticated attackers to alter order statuses in WooCommerce by marking pending orders as paid or completed. This vulnerability impacts data integrity but does not affect confidentiality or availability. The CVSS score of 5.3 reflects the network attack vector with low complexity and no privileges or user interaction required.

An attacker can modify WooCommerce order statuses without authentication, potentially causing financial or operational discrepancies by falsely marking orders as paid or completed. There is no direct impact on confidentiality or availability reported. No known exploitation in the wild has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected redirect functionality or implementing additional authorization controls at the application or server level to prevent unauthorized order status changes.