Auth bypass in Nexi Xpay Build
CVE-2026-82211
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Nexi Xpay Build
Weakness classification (CWE)
References
- wpscan.com/vulnerability/c1ab38b4-2445-4a56-a47e-aab2b8e8de1e/ (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-82211?
- CVE-2026-82211 is a high-severity vulnerability in Nexi Xpay Build, classified under Missing Authorization. CVSS score: 8.2/10. Published 2026-10-07.
- How severe is CVE-2026-82211?
- High severity. CVSS v3 base score is 8.2 out of 10.