CVE-2026-82213 Overview
CVE-2026-82213 is an Insecure Direct Object Reference (IDOR) vulnerability in the Nexi XPay Build WordPress plugin, versions 7.6.1 through 7.6.2. The plugin fails to verify that a requested payment token belongs to the authenticated user. Unauthenticated attackers can retrieve other customers' stored card token references along with a valid authorization signature. The flaw is categorized under [CWE-639: Authorization Bypass Through User-Controlled Key].
Critical Impact
Unauthenticated attackers can enumerate saved payment token references belonging to other customers, exposing card token identifiers paired with valid authorization signatures.
Affected Products
- Nexi XPay Build WordPress plugin version 7.6.1
- Nexi XPay Build WordPress plugin version 7.6.2
- WordPress installations processing payments through the affected plugin range
Discovery Timeline
- 2026-09-11 - CVE-2026-82213 published to the National Vulnerability Database
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-82213
Vulnerability Analysis
The Nexi XPay Build plugin manages saved payment methods for WooCommerce customers by referencing stored card tokens issued by the Nexi payment gateway. When a customer requests a saved token during checkout or account operations, the plugin retrieves the token record without validating ownership against the current session.
An unauthenticated attacker can craft requests that specify arbitrary token identifiers. The server returns the referenced token together with a valid authorization signature. That signature is what the payment gateway uses to bind a request to a stored instrument, so its exposure undermines the guarantee that only the token owner can initiate a payment flow using the reference.
The vulnerability does not expose full primary account numbers (PANs), which remain vaulted at the payment processor. The impact is limited to token reference disclosure rather than raw cardholder data.
Root Cause
The root cause is a missing authorization check on the token retrieval endpoint. The plugin trusts the token identifier provided in the request instead of correlating it with wp_get_current_user() or the associated WooCommerce customer ID. This is a classic [CWE-639] authorization bypass through a user-controlled key.
Attack Vector
Exploitation requires network access to the WordPress site and no authentication or user interaction. An attacker iterates or guesses token identifiers, issues requests against the vulnerable endpoint, and collects responses containing token references and their signatures. See the WPScan Vulnerability Report for additional technical detail.
No verified proof-of-concept code has been published. The vulnerability mechanism should be understood in prose: the endpoint accepts a token identifier as input and returns the corresponding record without an ownership check.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-82213
Indicators of Compromise
- Unauthenticated HTTP requests to Nexi XPay Build plugin endpoints that reference token identifiers not associated with the requesting session.
- High-volume sequential or enumerative requests against payment token retrieval endpoints from a single source IP.
- Anomalous response payloads containing token and signature fields returned to unauthenticated clients.
Detection Strategies
- Inspect WordPress and web server access logs for repeated calls to Nexi XPay plugin routes lacking a valid authenticated session cookie.
- Correlate token identifier values across requests to detect enumeration patterns that iterate identifiers over short time windows.
- Deploy web application firewall (WAF) rules that flag unauthenticated access to plugin endpoints returning payment token data.
Monitoring Recommendations
- Enable verbose logging on the WooCommerce checkout and account subsystems to capture token access attempts with source IP and session context.
- Forward WordPress and reverse proxy logs to a centralized SIEM for correlation against enumeration and scraping behavior.
- Alert on outbound responses from /wp-admin/admin-ajax.php or plugin-specific routes that contain payment authorization signatures returned to unauthenticated clients.
How to Mitigate CVE-2026-82213
Immediate Actions Required
- Identify all WordPress sites running Nexi XPay Build versions 7.6.1 or 7.6.2 and prioritize them for patching.
- Restrict access to the plugin's token retrieval endpoints at the WAF or reverse proxy layer until a fixed version is deployed.
- Review payment processor logs for anomalous token usage that may indicate prior exploitation.
Patch Information
At the time of publication, refer to the WPScan Vulnerability Report for the current fixed version guidance. Upgrade the Nexi XPay Build plugin to a release later than 7.6.2 that includes the ownership validation fix.
Workarounds
- Temporarily disable the Nexi XPay Build plugin if patching is not immediately feasible and an alternate checkout flow is available.
- Enforce authentication on the affected plugin routes via a WAF rule that blocks unauthenticated requests referencing token identifiers.
- Rotate or invalidate stored payment tokens for customers whose token references may have been exposed during the vulnerable window.
# Example WAF rule (ModSecurity) to block unauthenticated token retrieval
SecRule REQUEST_URI "@rx /wp-admin/admin-ajax\.php" \
"chain,deny,status:403,id:1026822130,msg:'Block unauth Nexi XPay token access'"
SecRule ARGS:action "@rx nexi_xpay_get_token" \
"chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
