Skip to content
Sign in
8.2 High

CVE-2026-82211 The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its…

Description

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.

Affected products and versions

Product Affected versions Fixed in
Nexi XPay Build 7.0 7.0.0 → 7.6.2 No fix stated

Other CVEs of Nexi XPay Build

The 3 CVEs of Nexi XPay Build →
CVE-2026-82212 The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment… 7.5 High CVE-2026-82213 The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested… 5.3 Medium
Track this CVE