CVE-2026-82212: Nexi XPay Build WordPress Auth Bypass

CVE-2026-82212 Overview

CVE-2026-82212 affects the Nexi XPay Build WordPress plugin through version 7.6.2. The plugin fails to correctly validate the security token on its payment notification route. When a target order has no stored token, the plugin accepts the request as valid. Unauthenticated attackers can mark arbitrary orders as paid or flip genuinely paid orders to failed status. The flaw maps to CWE-345: Insufficient Verification of Data Authenticity and is reachable over the network without privileges or user interaction.

Critical Impact

Unauthenticated attackers can manipulate WooCommerce order payment status, enabling fraudulent order fulfillment and disruption of legitimate transactions on affected e-commerce sites.

Affected Products

• Nexi XPay Build WordPress plugin, all versions through 7.6.2
• WordPress sites running WooCommerce with the Nexi XPay payment gateway integration
• Online storefronts processing payments via the vulnerable notification endpoint

Discovery Timeline

• 2026-10-07 - CVE-2026-82212 published to NVD
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-82212

Vulnerability Analysis

The Nexi XPay Build plugin exposes a payment notification route that is reached by Nexi's gateway to confirm transaction outcomes. The route is intended to authenticate inbound notifications using a security token tied to each order. The plugin's validation logic treats a missing stored token as an acceptable condition rather than a verification failure. As a result, any request that targets an order without a stored token passes authentication checks and is processed as a legitimate payment update.

This is a business logic authentication bypass in a payment integration. An attacker does not need to forge cryptographic material, replay a captured token, or compromise credentials. They only need to identify an order ID whose token record is empty or absent and craft a notification request against it.

Root Cause

The root cause is improper verification of data authenticity on the notification endpoint. The handler conflates "no token stored" with "no token required." A correct implementation would reject any notification for an order that cannot be matched to a non-empty, cryptographically verified token. The missing check converts a server-to-server trust boundary into an open endpoint.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends a crafted HTTP request to the plugin's Nexi notification URL, referencing a WooCommerce order ID that has no stored token. The plugin processes the notification and updates the order state. Attackers can mark unpaid orders as paid to trigger fulfillment of physical or digital goods. They can also mark genuinely paid orders as failed, causing refund disputes, cancellations, and operational disruption.

No verified public exploit code is referenced in the advisory. Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-82212

Indicators of Compromise

• Inbound HTTP requests to the Nexi XPay notification endpoint from source IPs that do not belong to Nexi's gateway infrastructure
• WooCommerce orders transitioning to completed or processing without a corresponding entry in the payment gateway's transaction log
• Legitimate paid orders flipped to failed status shortly after an external notification request
• Order status changes correlated with empty or missing token fields in the plugin's order metadata

Detection Strategies

• Review web server access logs for requests to the Nexi payment notification route and compare source addresses against Nexi's documented IP ranges
• Reconcile WooCommerce order status changes against gateway-side transaction records to surface unmatched updates
• Alert on order state transitions where the stored Nexi token metadata is empty at the time of the notification

Monitoring Recommendations

• Enable verbose logging for the Nexi XPay plugin and forward events to a centralized SIEM
• Monitor WooCommerce order audit trails for high-velocity status changes from a single IP or user agent
• Track refund and chargeback volume as a lagging indicator of fraudulent paid manipulation

How to Mitigate CVE-2026-82212

Immediate Actions Required

• Audit all WordPress sites for the Nexi XPay Build plugin and confirm installed versions
• Restrict access to the plugin's notification endpoint at the web server or WAF layer, allowlisting only Nexi gateway source IPs
• Manually reconcile recent WooCommerce orders against gateway records to identify unauthorized status changes

Patch Information

The advisory covers Nexi XPay Build through version 7.6.2. Site operators should consult the vendor and the WPScan Vulnerability Report for the fixed release and apply the update as soon as it becomes available. Until a patched version is installed, treat the notification endpoint as untrusted.

Workarounds

• Disable the Nexi XPay Build plugin until a fixed version is released if transaction volume allows
• Enforce IP allowlisting on the notification URL via web server rules or a WAF
• Add a reverse proxy rule that rejects notification requests for orders lacking a non-empty stored token

# Example nginx allowlist for the Nexi notification endpoint
location ~* /\?wc-api=WC_Gateway_XPay {
    allow  <nexi_gateway_ip_range>;
    deny   all;
    proxy_pass http://wordpress_backend;
}