CVE-2026-82213mediumCWE-639

CVE-2026-82213: medium-severity vulnerability in Nexi XPay Build

Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR

Published

Follow this CVE+ Monitor Nexi XPay

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.3%
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · Nexi XPay Build
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Nexi XPay Build

In the same product, most dangerous first.

CVE-2026-82211HIGHNexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key DisclosureEPSS 0.2%CVE-2026-82212HIGHNexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification HandlerEPSS 0.1%