Nexi XPay Build WordPress plugin versions up to 7.6.2 accept payment notification requests without correctly validating the security token; when the target order has no stored token, any requester can trigger a status change. An attacker who crafts such a notification can mark an unpaid order as paid or force a legitimately paid order to fail, resulting in unauthorized fund transfers or order cancellations. The vulnerability permits the attacker to alter the financial status of any order on the site without authentication, and thus it directly compromises the integrity of transaction data.

WordPress sites that have installed the Nexi XPay Build plugin with a version 7.6.2 or earlier. The attack exploits the payment notification endpoint exposed by the plugin, which is accessible to all users, including unauthenticated visitors.

The CVSS score for this issue is 7.5, indicating a high severity The EPSS score is unavailable, but the exploit is straightforward: sending a synthetic payment notification request with an unsigned or missing token to the plugin’s endpoint. The vulnerability is not listed in the CISA KEV catalog, though its impact could be wide in e‑commerce deployments. Attackers could easily automate notification requests, and because no authentication is required, the window for exploitation is continuously open until patched. Organizations running affected WordPress sites should treat this as a high‑risk flaw that should be remediated promptly.