CVE-2026-82211

Summary

The Nexi XPay Build WordPress plugin fails to verify payment results in unauthenticated routes, allowing attackers to manipulate order statuses and access guest buyer details without authentication.

Exploitability

Exploitation is straightforward with no prerequisites, requiring only access to the plugin's unauthenticated endpoints to manipulate order states and extract sensitive information.

Blast radius

If exploited, attackers could mark arbitrary orders as paid or failed, cancel legitimate orders, and expose guest buyers' personal details, potentially leading to financial fraud and privacy breaches.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 7.6.3 or later to address the authentication verification flaw in payment result handling.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.