CVE-2026-82212

Summary

The Nexi XPay WordPress plugin fails to validate security tokens on its payment notification endpoint, allowing unauthenticated attackers to mark any order as paid or failed by exploiting a missing token validation check.

Exploitability

Exploitation is straightforward with no prerequisites; attackers only need to send a specially crafted request to the payment notification route without needing authentication or valid tokens.

Blast radius

The impact could be significant across all orders processed through the vulnerable plugin, potentially allowing unauthorized revenue recognition and order status manipulation for any customer who has made a purchase.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 7.6.3 or later which includes the security token validation fix for the payment notification route.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.