CVE-2026-82212: CWE-345 Insufficient Verification of Data Authenticity in Nexi XPay Build

The Nexi XPay Build WordPress plugin through version 7.6.2 contains an insufficient verification of data authenticity vulnerability (CWE-345). Specifically, the plugin does not correctly validate the security token on its payment notification route if the target order has no stored token. This allows unauthenticated attackers to manipulate order payment status by marking arbitrary orders as paid or marking genuinely paid orders as failed, potentially disrupting payment processing integrity.

An attacker can exploit this vulnerability without authentication to alter the payment status of orders arbitrarily. This can lead to financial discrepancies, such as unauthorized marking of unpaid orders as paid or reversing genuinely paid orders to failed status. The integrity of payment processing is compromised, which could affect business operations and customer trust.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, monitor vendor communications for updates and consider implementing additional validation controls on payment notification routes if possible.