CVE-2026-82213CWE-639

CVE-2026-82213

Medium · published September 11, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
24.1
In the wild
Unconfirmed
What it is

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00323 · 24.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-11T15:16Z
References (1)
https://wpscan.com/vulnerability/ccdf87ac-7442-441f-ad96-466c715b1d66/ · [email protected]
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 10:56Z
    Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR
    cvelistv5