CVE-2026-82213— Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR
Quick assessment
Affected
Unknown Nexi XPay Build
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Nexi XPay Build WordPress 插件从 7.6.1 到 7.6.2 版本未验证所请求的已保存支付令牌是否属于当前用户，这使得未认证的攻击者能够获取其他客户存储的银行卡令牌引用，并附带一个有效的授权签名。
Possible ATT&CK Techniques 1 AI
T1083 · File and Directory DiscoveryAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Nexi XPay Build | 7.6.1≤ 7.6.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82213
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR
Source: CVE Program / CVE List V5
Vulnerability Description
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Nexi XPay Build | 7.6.1 ~ 7.6.2 | - |
|
II. Public POCs for CVE-2026-82213
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82213
请登录查看更多情报信息。
Exploits & Public PoCs for CVE-2026-82213 (1)
-
🔗 Nexi XPay Build 7.6.1 – 7.6.2 – Unauthenticated Saved Payment Token Disclosure via IDOR | CVE 2026-82213 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-11 · 24 CVEs total
| CVE-2026-85116 | 6.5 MEDIUM | Simple CAPTCHA with Cloudflare Turnstile 1.2.2 - 1.42.1 - Unauthenticated Arbitrary Shortc |
| CVE-2026-82215 | 5.9 MEDIUM | WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook |
| CVE-2026-86809 | 5.3 MEDIUM | Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass |
| CVE-2026-86813 | 4.8 MEDIUM | MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To |
| CVE-2025-15695 | GTranslate < 3.0.10 - Admin+ Stored XSS | |
| CVE-2026-14559 | Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover | |
| CVE-2026-83545 | CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON | |
| CVE-2026-83546 | CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute | |
| CVE-2026-14566 | Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tamperi | |
| CVE-2026-14560 | Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload | |
| CVE-2026-14565 | Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configurat | |
| CVE-2026-14563 | Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover | |
| CVE-2026-14562 | Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure | |
| CVE-2026-74925 | MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator | |
| CVE-2026-85677 | Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content | |
| CVE-2026-85678 | AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript | |
| CVE-2026-82305 | YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_ | |
| CVE-2026-86781 | SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure | |
| CVE-2026-86780 | Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text | |
| CVE-2026-86779 | Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-96173
Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disc -
CVE-2026-96200
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confir -
CVE-2026-96255
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gatewa -
CVE-2026-89296
Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Pa -
CVE-2026-87973
If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS vi
V. Comments for CVE-2026-82213
No comments yet