CVE-2025-15565 is a missing authorization vulnerability in the Nexi XPay plugin for WordPress, affecting all versions up to and including 8.3.0. The issue arises from the lack of authorization checks on the redirect function, enabling unauthenticated attackers to alter the status of WooCommerce orders from pending to paid or completed. This vulnerability is classified under CWE-862. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required. No vendor patch or official remediation has been published yet.

An attacker can exploit this vulnerability to fraudulently mark pending WooCommerce orders as paid or completed without authentication. This could lead to unauthorized order fulfillment or financial discrepancies. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected redirect function or implementing additional authorization controls at the application or server level to prevent unauthorized status changes. Monitor vendor communications for updates on patches or official mitigations.