Is CVE-2026-82213 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-82213?

CVE-2026-82213 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-82213

Description

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.