CVE-2026-82211
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.
Risk Assessment
Attackers can manipulate payment statuses and access customer personal data, potentially leading to financial fraud and privacy breaches.
Recommendation
Update the Nexi XPay Build plugin to the latest version and implement server-side verification of payment results.
Other vulnerabilities in Nexi XPay Build WordPress plugin
Original NVD description (English source)
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS