CVE-2026-82211
Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure
CVSS Score
8.2
EPSS Score
0.0%
EPSS Percentile
0th
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.
| Vendor | unknown |
| Product | nexi xpay build |
| Published | Oct 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown nexi xpay build
Be the first to know when new high vulnerabilities affecting unknown nexi xpay build are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Nexi XPay Build
7.0.0 ≤ 7.6.2
References
Credits
Naoki Kawahigashi WPScan