CVE-2026-82212: Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler

Q: Which orders are susceptible to manipulation?

Orders that have no stored security token are susceptible. An attacker can use the payment notification route to mark those orders as paid or change genuinely paid orders to failed.

Q: Does exploitation require an account or user interaction?

No. The issue is remotely exploitable with low attack complexity and requires neither authentication nor user interaction.

Published Oct 7, 2026

Updated

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid orders as failed.

Affected Software

1 affected component

Nexi XPay Build WordPress plugin<=7.6.2

Event History

Oct 7, 2026

CVE Published

via MITRE·06:47 AM

Data Sourced

via MITRE·06:47 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which orders are susceptible to manipulation?

Orders that have no stored security token are susceptible. An attacker can use the payment notification route to mark those orders as paid or change genuinely paid orders to failed.

Does exploitation require an account or user interaction?