{"id":"CVE-2026-82211","published":"2026-10-07T07:17:01.373","lastModified":"2026-10-07T14:52:43.420","description":"The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/c1ab38b4-2445-4a56-a47e-aab2b8e8de1e/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Nexi XPay Build WordPress plugin fails to verify payment results in unauthenticated routes, allowing attackers to manipulate order statuses and access guest buyer details without authentication.","exploitability":"Exploitation is straightforward with no prerequisites, requiring only access to the plugin's unauthenticated endpoints to manipulate order states and extract sensitive information.","blast_radius":"If exploited, attackers could mark arbitrary orders as paid or failed, cancel legitimate orders, and expose guest buyers' personal details, potentially leading to financial fraud and privacy breaches.","remediation":"Upgrade to version 7.6.3 or later to address the authentication verification flaw in payment result handling.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["e-commerce","payment-processing","order-manipulation"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:56:32.249Z"}}