WordPress Plugin Vulnerabilities

Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR

Description

The plugin does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.

Proof of Concept

Affects Plugins

Plugin icon
nexi-xpay-build
No known fix

References

CVE
CVE-2026-82213

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
ryan fabella
Submitter
ryan fabella
Verified
Yes
WPVDB ID
ccdf87ac-7442-441f-ad96-466c715b1d66

Timeline

Publicly Published
2026-09-08 (about 3 days ago)
Added
2026-09-01 (about 10 days ago)
Last Updated
2026-09-01 (about 10 days ago)

Other

Published
Title
Published
2022-06-28
Title
SP Project & Document Manager < 4.58 - Sensitive File Disclosure
Published
2024-11-26
Title
ProfilePress < 4.15.19 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Published
2025-12-04
Title
AI CoPilot < 1.2.8 - Authenticated (Contributor+) Information Exposure
Published
2023-12-28
Title
Send Users Email < 1.4.4 - Sensitive Information Exposure via Error Logs
Published
2025-11-10
Title
Shelf Planner <= 2.7.0 - Unauthenticated Information Exposure via Log Files