Nexi XPay Build: Missing order token permits forged payment notifications
An unauthenticated attacker can submit a payment notification for an order that has no stored security token. The notification route accepts that missing-token condition instead of rejecting it, allowing arbitrary orders to be marked paid or genuinely paid orders to be marked failed. The route and token parameter names are undisclosed. Affected versions: 7.2.2 through 7.6.2. No fixed release is confirmed.
- Component
- Nexi XPay Build
- Plugin slug
nexi-xpay-build- Affected
- 7.2.2 through 7.6.2
- Safe version
- See mitigation notes
- Published
- Oct 07, 2026
This CVE was published Oct 07, 2026 and is one of 3 known issues for this plugin.
Update, patch or deactivate.
No fixed release is confirmed. Disable the affected feature or deactivate the component until a confirmed fix is available. Application-level remediation: Reject notifications when the expected order token is absent or mismatched, verify the provider's authenticated payment result, and bind it to the order, amount, currency and permitted state transition. Review payment statuses against provider records.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid orders as failed.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N