CVE-2026-82211: CWE-862 Missing Authorization in Nexi XPay Build

The Nexi XPay Build WordPress plugin versions 7.0.0 through 7.6.2 suffer from a missing authorization vulnerability (CWE-862) in multiple unauthenticated routes. These routes do not verify the payment result properly, enabling attackers without authentication to alter order states (mark as paid or failed), cancel orders, and retrieve order keys that reveal guest buyers' personal details. This vulnerability has a CVSS 3.1 base score of 8.2, indicating high impact primarily due to integrity and limited confidentiality impacts, with no availability impact.

Exploitation allows unauthenticated attackers to manipulate order statuses, potentially causing financial and operational disruption by marking orders as paid or failed incorrectly or canceling them. Additionally, attackers can access order keys that expose guest buyers' personal information, leading to privacy breaches. There is no known active exploitation in the wild at this time.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to affected routes if possible and monitor for suspicious activity related to order manipulation.