CVE-2026-82213
Received Received - Intake

Unauthenticated Payment Token Exposure in Nexi XPay WordPress Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: WPScan

Description
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-82213
EUVD
EUVD-2026-76037

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nexi xpay 7.6.1
nexi xpay 7.6.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Nexi XPay WordPress plugin versions 7.6.1 to 7.6.2. It allows unauthenticated attackers to retrieve other customers' stored payment card tokens along with valid authorization signatures because the plugin does not verify if the requested token belongs to the current user.

Detection Guidance

To detect this vulnerability, check if the Nexi XPay WordPress plugin versions 7.6.1 or 7.6.2 are installed. Review server logs for unauthorized access attempts to payment token endpoints or unusual requests fetching stored tokens.

Impact Analysis

This vulnerability exposes sensitive payment information of other users, including card token references and authorization signatures. Attackers could misuse this data for fraudulent transactions or sell it on the dark web. Users of the affected plugin versions are at risk of unauthorized access to payment details.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal payment data and potential data breaches. It may also conflict with PCI DSS requirements for protecting cardholder data. Organizations using this plugin could face regulatory fines and reputational damage.

Mitigation Strategies

Immediately update the Nexi XPay plugin to the latest version if available. If no patch exists, disable the plugin temporarily until an official fix is released. Monitor network traffic for suspicious activity related to payment token access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82213. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart