Nexi XPay Build WordPress plugin: Missing authorization in payment routes
Summary
The Nexi XPay Build WordPress plugin up to and including 7.6.2 does not verify the payment result on several unauthenticated routes. An unauthenticated remote attacker can mark arbitrary orders as paid or failed, cancel them, and obtain order keys that expose guest buyers' details. No login is required, so any internet-facing WooCommerce shop running the plugin is reachable.
Affected
- Nexi XPay Build WordPress plugin, versions 7.0.0 to 7.6.2 (per WPScan and third-party aggregators)
Fixed in
- Unknown. No vendor advisory or confirmed fixed version found.
- Do not assume that 7.6.3 or 8.0.0 fixes this CVE without confirmation.
Workaround
- Restrict access to the payment notification endpoint to IP addresses of the payment gateway provider (confirm Nexi source IP ranges with Nexi first).
- Review order logs for unexpected status changes, cancellations and order-detail access.
- Disable the plugin or payment method until a fixed version is confirmed, if payments can be accepted another way.
Exploitation
- No evidence of exploitation found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Not listed in CISA KEV.
- No public proof of concept found; this search was not exhaustive.
Our recommendation
- Identify clients running the plugin at version 7.6.2 or earlier.
- Obtain the WPScan entry and Nexi's notice to confirm the fixed version.
- Apply the endpoint restriction and log review until a fix is confirmed, or disable the plugin if the shop can run without it.
- If logs show unexpected order changes or guest-data access, treat it as a potential personal-data incident and check reporting obligations under the nFADP with the customer.
- Assess together with CVE-2026-82212 and CVE-2026-82213.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- Strix CVE-2026-82211 www.strix.ai
- OffSeq radar CVE-2026-82211 radar.offseq.com
- OpenCVE CVE-2026-82211 app.opencve.io
- VulDB CVE-2026-82212 (endpoint restriction and log review guidance) vuldb.com
- WordPress.org plugin page (cartasi-x-pay) wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:55.
Original description (NVD)
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.