CVE-2026-82212

Executive Summary

CVE-2026-82212 is an improper verification of cryptographic signature vulnerability (CWE-345) in the Nexi XPay Build WordPress plugin, affecting all versions through 7.6.2. The plugin fails to properly validate the security token on its payment notification route, accepting requests when the target order has no stored token. This allows unauthenticated remote attackers to arbitrarily manipulate WooCommerce order payment status — marking unpaid orders as paid or genuinely paid orders as failed — with no user interaction required and no public exploit currently available.

Technical Analysis

The vulnerability resides in the payment notification (callback/webhook) handling logic of the Nexi XPay Build WordPress plugin. Payment gateways typically implement a server-to-server callback endpoint that the payment processor invokes to communicate transaction outcomes. This endpoint must authenticate the origin of each request using a shared secret token or cryptographic signature, because the endpoint is necessarily reachable without a WordPress user session (the payment processor calls it, not a logged-in user).

CWE-345 (Insufficient Verification of Data Authenticity) captures the core defect here: the plugin's token validation routine is conditional in a way that creates a fail-open path. According to the NVD description, the plugin "does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token." This indicates the validation logic short-circuits — if no token is present in the order's stored metadata, the comparison either performs no check or trivially passes, rather than rejecting the request.

The attack surface is the publicly reachable payment notification route registered by the plugin. Because the route is designed for unauthenticated server-to-server traffic, it does not sit behind WordPress authentication or capability checks. The vulnerability is therefore remotely exploitable by any party who can reach the site over HTTP(S), with attack complexity LOW and no privileges or user interaction required, consistent with the CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N).

The integrity impact is HIGH (I:H) because the callback directly drives WooCommerce order state transitions — specifically the paid and failed statuses. Confidentiality and availability impacts are NONE per the vector. Scope is unchanged (S:U); the flaw affects only the plugin's own order-state handling within the WordPress/WooCommerce context.

Critically, no exploit code, proof-of-concept, or Nuclei template is publicly available, and EPSS has not yet scored this CVE. The attack chain described below is inferred from the vulnerability class and the NVD description; no specific function names, parameter names, or code paths beyond those stated in the description are asserted.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-345) and the NVD description. It uses only behaviors and route concepts stated in the description.

1. Reconnaissance / target identification: The attacker identifies WordPress sites running WooCommerce with the Nexi XPay Build plugin (versions through 7.6.2). Fingerprinting can be done by observing plugin assets under the site's plugin directory or by detecting the presence of the plugin's payment notification route. Because the route is unauthenticated and part of normal payment flow, it is externally reachable.

2. Triggering the flaw: The attacker sends a crafted HTTP request to the plugin's payment notification route for a chosen order. The request is crafted to represent a payment notification. Per the description, the decisive condition is that the target order has no stored token — in that case the plugin's validation fails open and accepts the request. The attacker therefore selects (or enumerates) an order lacking a stored token to satisfy this condition.

3. Payload / execution at the vulnerability-class level: This is a data-authenticity failure rather than code injection. The "payload" is a forged notification message that, under correct validation, would be rejected. Because the token check is bypassed by the missing-token condition, the forged notification is processed as authentic and is applied to the referenced order's status.

4. Post-exploitation impact: The attacker can mark arbitrary orders as paid without any actual payment, causing the merchant to release goods or services against fraudulent orders (financial/revenue loss, inventory shrinkage). Conversely, the attacker can mark genuinely paid orders as failed, degrading order fulfillment, triggering refund workflows, and damaging customer trust and reconciliation records. Because order state often feeds downstream systems (ERP, fulfillment, accounting), the manipulation can propagate beyond the storefront.

Impact Assessment

The vulnerability enables unauthenticated, low-complexity remote manipulation of order payment status. Per CVSS v3.1 with a base score of 7.5, the integrity impact is HIGH while confidentiality and availability are NONE (C:N/I:H/A:N), scope unchanged, and no privileges or user interaction required.

Business impact centers on financial and operational integrity:

• Fraudulent order fulfillment: orders marked as paid without payment can lead to goods shipped or services rendered at a loss.
• Denial of fulfillment for paid orders: flipping paid orders to failed can block or reverse legitimate fulfillment, causing customer disputes, chargebacks, and support cost.
• Accounting and reconciliation corruption: payment status is a source of truth for bookkeeping and gateway reconciliation; corruption undermines financial reporting.
• Reputational harm: customers receiving goods without charge or seeing valid payments rejected erodes trust in the merchant.

Blast radius is limited to each affected WordPress/WooCommerce installation and the downstream systems that consume order status. There is no lateral movement into unrelated systems implied by the flaw itself, but the attacker can affect any order reachable through the plugin's notification route. Because exploitation requires only network access to the site and no authentication, the effective attack surface is the entire set of internet-facing sites running the vulnerable plugin version.

Detection Guidance

Sigma Rule

title: Suspicious WooCommerce Order Status Change via Nexi XPay Payment Notification Route
id: 8f2c1e7a-3b4d-4c9e-9a11-7c5e2f0b6d84
status: experimental
description: Detects order status transitions to paid/failed potentially triggered by forged payment notifications abusing CVE-2026-82212 (missing token fail-open).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-82212
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: wordpress
  service: woocommerce
detection:
  selection_action:
    action:
      - 'order_status_paid'
      - 'order_status_failed'
  selection_source:
    source|contains:
      - 'nexi'
      - 'xpay'
  condition: selection_action and selection_source
falsepositives:
  - Legitimate Nexi XPay payment notifications
level: medium
tags:
  - attack.t1190

YARA Rule

rule CVE_2026_82212_Nexi_XPay_Token_Bypass
{
    meta:
        description = "Detects Nexi XPay Build plugin payment notification handling with conditional token validation (CVE-2026-82212)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-82212"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "high"

    strings:
        $p1 = "nexi-xpay-build" ascii nocase
        $s1 = "payment notification" ascii nocase
        $s2 = "security token" ascii nocase
        $s3 = "xpay" ascii nocase
        $s4 = "wc_get_order" ascii nocase

    condition:
        $p1 and (1 of ($s1, $s2, $s3)) and $s4
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82212 Nexi XPay Build WordPress plugin payment notification token bypass (potential forged order status change)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"nexi-xpay-build"; nocase; http.uri; content:"notification"; nocase; classtype:attempted-admin; reference:cve,2026-82212; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-82212; sid:202682212; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "GET" and
      stringContains(network.url.path, "nexi-xpay-build") and
      stringContains(network.url.path, "notification") ]
  [ network where stringContains(network.url.path, "nexi-xpay-build") and
      http.response.status_code == 200 ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*nexi-xpay-build*" uri_path="*notification*"
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status_codes
        dc(clientip) as unique_sources by uri_path, clientip
| where count > 0
| rename clientip as src_ip
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,nexi_xpay,">
  <rule id="100822" level="10">
    <if_sid>31100</if_sid>
    <url>nexi-xpay-build</url>
    <match>notification</match>
    <description>CVE-2026-82212: Access to Nexi XPay Build payment notification route - possible token bypass / forged order status change</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,pci_dss_6.5,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• If the plugin's payment notification functionality is not required, disable or deactivate the Nexi XPay Build plugin until a fixed version is available.
• Restrict access to the payment notification route at the network edge where operationally feasible, permitting only the payment provider's expected source infrastructure; note this can be brittle because processor IPs change, so it is a compensating control, not a fix.
• Ensure the callback route does not treat a missing stored token as a valid state. This is a logic defect specific to the plugin; site operators cannot fully correct it without vendor code changes.
• Monitor and audit WooCommerce order status transitions daily for anomalies (orders moved to paid/failed without corresponding gateway reconciliation records).

2. Patch/upgrade steps:

• No patched version is currently available through any tracked source. Track the vendor's plugin page and the NVD entry for CVE-2026-82212 to adopt a fixed release as soon as it is published.
• Once a fix is released, update the plugin to the earliest version that corrects the token validation logic.

3. Long-term hardening:

• Enforce strict denial when a stored token is absent — fail-closed validation for all payment callbacks.
• Require cryptographic signature verification (e.g., HMAC over the entire notification body plus a timestamp) rather than a simple token presence check.
• Cross-validate every callback against the payment gateway's authoritative API before changing order status.
• Apply least privilege and integrity logging to order state changes; alert on status transitions lacking corroborating gateway records.
• Maintain a plugin inventory and vulnerability monitoring process so payment-gateway plugins are patched promptly.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-82212
• CWE-345 — Insufficient Verification of Data Authenticity: https://cwe.mitre.org/data/definitions/345.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (not yet scored at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-82212 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog