CVE-2026-82213 — Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR

CVE-2026-82213

Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR PUBLISHED

Description (CNA)

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.

Affected (CNA)

Vendor / product	Versions
Unknown / Nexi XPay Build	affected 7.6.1 through 7.6.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/ccdf87ac-7442-441f-ad96-466c715b1d66/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.