[ CVE-2026-82211 · Published 7 Oct 2026 ]
Vulnerability in Unknown Nexi XPay Build
CVSS 8.2
EPSS <1%No fix listed yet
[ Description ]Official description
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.