CVE-2026-82213

MediumCVSS 5.3

Published: 11/09/2026(UTC)Updated: 11/09/2026(UTC)Translated: 11/09/2026(UTC)NVD NIST

Summary

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user. This allows unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.

Risk Assessment

An attacker could gain access to other customers' payment card tokens, potentially leading to unauthorized transactions and data theft. This is a serious breach of privacy and financial security.

Recommendation

Update the Nexi XPay Build plugin to a version later than 7.6.2. Verify that the plugin validates payment token ownership before use.

Other vulnerabilities in Nexi XPay Build WordPress plugin

CVE-2026-82211High
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.

Original NVD description (English source)

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS