Skip to content
Sign in
5.3 Medium

CVE-2026-82213 The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested…

Description

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.

Affected products and versions

Product Affected versions Fixed in
Nexi XPay Build 7.6 7.6.1 → 7.6.2 No fix stated

Other CVEs of Nexi XPay Build

The 3 CVEs of Nexi XPay Build →
CVE-2026-82212 The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment… 7.5 High CVE-2026-82211 The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its… 8.2 High
Track this CVE