CVE-2026-82211
Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure
Unknown Nexi XPay Build
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
What fixes it
No source in this snapshot names a fixed version.
Description
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.
Text from CVE List
Affected versions 1
- Nexi XPay Buildaffected: 7.0.0 through 7.6.2CVE List