The Nexi XPay Build plugin for WordPress, versions up to 7.6.2, fails to verify payment results on several unauthenticated routes. Attackers can exploit these gaps to mark arbitrary orders as paid or failed, cancel orders, and retrieve order keys that reveal guest buyers’ personal details. The flaw represents a broken access control that also leads to information disclosure. The primary impact is financial manipulation and exposure of sensitive customer data.

Vendors: Unknown Product: Nexi XPay Build WordPress plugin Affected versions: all builds through 7.6.2

The vulnerability scores a CVSS of 8.2, indicating a high severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog, but the lack of authentication on the affected routes indicates that exploitation can be performed directly over HTTP(S) without user credentials. An attacker only needs knowledge of the vulnerable endpoints and can issue simple requests to manipulate order states and harvest order keys, leading to potential financial loss and privacy violations. The high CVSS, combined with an easily exploitable attack vector and lack of official mitigation propagation, presents an urgent risk to sites using the affected plugin.