CVE-2026-82213: Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it; no account or user interaction is required. The affected plugin versions are 7.6.1 through 7.6.2.
What information could be exposed?
Attackers may retrieve other customers' stored card token references and a valid authorisation signature. The provided data does not indicate exposure of full card numbers or other payment details.
What access-control failure causes the disclosure?
The plugin does not verify that a requested saved payment token belongs to the current user. This allows an attacker to request token data associated with other customers.