{"id":"CVE-2026-82212","published":"2026-10-07T07:17:01.493","lastModified":"2026-10-07T14:52:43.420","description":"The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid orders as failed.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-345"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/66df6adb-336c-4660-9a63-5e6e550a2edb/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Nexi XPay WordPress plugin fails to validate security tokens on its payment notification endpoint, allowing unauthenticated attackers to mark any order as paid or failed by exploiting a missing token validation check.","exploitability":"Exploitation is straightforward with no prerequisites; attackers only need to send a specially crafted request to the payment notification route without needing authentication or valid tokens.","blast_radius":"The impact could be significant across all orders processed through the vulnerable plugin, potentially allowing unauthorized revenue recognition and order status manipulation for any customer who has made a purchase.","remediation":"Upgrade to version 7.6.3 or later which includes the security token validation fix for the payment notification route.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["payment","order","wordpress"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:03:57.547Z"}}