CVE-2026-82212
Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid orders as failed.
| Vendor | unknown |
| Product | nexi xpay build |
| Published | Oct 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown nexi xpay build
Be the first to know when new high vulnerabilities affecting unknown nexi xpay build are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Nexi XPay Build
7.2.2 ≤ 7.6.2
References
Credits
Pablo González Pérez Francisco José Ramírez Vicente Iñigo Sánchez Enciso WPScan