blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-82212

HIGH 7.5 CVSS 3.1
Published
October 7, 2026
Last modified
October 7, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-345
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid orders as failed.

Affected products and versions

  • Unknown Nexi XPay Build — From 7.2.2 (including) to 7.6.2 (including)

References

  • wpscan.com https://wpscan.com/vulnerability/66df6adb-336c-4660-9a63-5e6e550a2edb/
  • nvd.nist.gov Official NVD record