MajorCritical vulnerability

CVE-2026-82211 (CVSS 8.2)

NVD · officialPublished Oct 7, 2026Risk 37/100

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.

Technical details

CVSS

8.2

AV:NetworkAC:LowPR:NoneUI:NoneC:LowI:HighA:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source