CVE-2026-82211 in Nexi XPay Build Plugin
Summary
by MITRE • 10/07/2026
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The Nexi XPay Build WordPress plugin version 7.6.2 contains a critical security vulnerability rooted in the absence of server-side validation for payment status callbacks received from external gateways. This flaw specifically affects unauthenticated API endpoints that are designed to receive asynchronous notifications regarding transaction outcomes. In secure e-commerce architectures, it is imperative that any state change triggered by an external party, such as a payment processor confirming receipt of funds or signaling failure, be rigorously verified against the authoritative source of truth rather than trusting client-supplied data blindly. The vulnerability arises because the plugin accepts status updates without verifying their authenticity or integrity, allowing malicious actors to manipulate transaction states at will.
This lack of verification enables attackers to perform unauthorized state transitions on arbitrary orders within the WordPress database. By sending crafted requests to these unauthenticated routes, an adversary can force specific order records to be marked as paid even if no actual payment was processed, effectively obtaining goods or services without financial compensation. Conversely, attackers can also mark legitimate pending payments as failed, potentially disrupting business operations and causing customer dissatisfaction by incorrectly canceling valid transactions. This manipulation of the order lifecycle represents a severe breach of data integrity and undermines the fundamental trust model required for online commerce platforms to function securely.
Beyond the direct impact on transactional integrity, this vulnerability facilitates significant information disclosure risks. The ability to manipulate orders allows attackers to retrieve sensitive order keys associated with guest buyers. These keys often serve as unique identifiers that can be used to access or infer personal details of customers who did not create accounts during checkout, such as names, email addresses, and shipping addresses. This exposure violates privacy expectations and may lead to further social engineering attacks or identity theft against affected users. The combination of state manipulation and data leakage creates a multifaceted threat that compromises both the financial security of the merchant and the personal privacy of their customer base.
From an industry standard perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to validate or incorrectly validates input received from external sources before processing it. Additionally, the exploitation technique relates to CWE-345 Insufficient Verification of Data Authenticity, where trust is placed in data without confirming its origin or integrity. In terms of offensive security frameworks like MITRE ATT&CK, this behavior corresponds to techniques involving Tampering with stored data and potentially exploiting API endpoints for unauthorized access. The unauthenticated nature of the affected routes further exacerbates the risk by removing any barrier that might otherwise limit exploitation to authenticated users only.
To mitigate these risks, immediate action is required from plugin developers and site administrators. Developers must implement robust server-side validation mechanisms for all payment callback endpoints. This includes verifying digital signatures or tokens provided by the payment gateway to ensure that status updates originate from legitimate sources. It is also essential to enforce strict access controls on administrative functions and API routes, ensuring that only authenticated users with appropriate privileges can trigger state changes or view sensitive order details. For site administrators using this plugin version, it is critical to update to a patched release as soon as one becomes available. Until then, restricting public access to the affected endpoints via web application firewall rules or server configuration may provide temporary relief against exploitation while minimizing disruption to legitimate payment processing workflows.