What’s Vulnerable › Vulnerabilities
CVE-2026-82213: Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-11 · updated 2026-09-11
- Weakness: CWE-639
Description
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.
Affected products
- Nexi XPay Build: from 7.6.1 through 7.6.2
References
Get alerted when CVE-2026-82213 or the next vulnerability affects your stack