CVE-2026-82213

Executive Summary

CVE-2026-82213 is an unauthenticated authorization bypass in the Nexi XPay Build WordPress plugin versions 7.6.1 through 7.6.2, in which the plugin fails to verify that a requested saved payment token belongs to the current user. An unauthenticated attacker can request another customer's stored card token reference and receive it together with a valid authorization signature, exposing payment data to cross-account retrieval. With a CVSS base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) the flaw is network-reachable and trivially exploitable, but rated to have only low confidentiality impact because the exposed token reference requires the associated signature and further processing to realize full payment misuse.

Technical Analysis

The vulnerable component is the Nexi XPay Build WordPress plugin. The core defect is an object-level authorization failure: the plugin does not verify that the saved payment token being requested belongs to the current user. WordPress payment plugins typically expose public-facing AJAX handlers (e.g., admin-ajax.php or REST endpoints) that accept a token/identifier parameter and return stored payment metadata. Because the endpoint does not bind the requested token to the authenticated (or session) user identity, any requester can supply or enumerate another customer's token reference.

Two properties make this CVE distinctive and increase its real-world severity beyond a simple data leak:

1. Unauthenticated access. The CVSS vector specifies PR:N/UI:N — no privileges or user interaction are required. The attacker does not need a WordPress account, a customer login, or a victim to click anything. The request can be issued directly against the site.

2. Signature disclosure. The plugin returns the token reference together with a valid authorization signature. This is significant: in the Nexi XPay flow the signature is the cryptographic element that authorizes use of the token. Disclosing both the token and its signature in a single response means the attacker obtains a self-consistent pair, substantially lowering the effort required to attempt unauthorized payment operations compared to leaking the token alone.

The underlying weakness is best classified as CWE-639 (Authorization Bypass Through User-Controlled Key), also referred to as insecure direct object reference (IDOR) at the object level. The token acts as the user-controlled key; the missing check is the ownership binding between token and current user.

The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) grades this as low confidentiality impact only, with no integrity or availability impact and no scope change. This reflects that the immediate outcome is disclosure of a token reference plus a signature; whether that escalates to fraudulent transactions depends on downstream merchant configuration, PSP-side controls, token single-use semantics, and binding to additional buyer authentication such as 3-D Secure. The exploitability subscores (AV:N, AC:L, PR:N, UI:N) are maximal, which is why the base score of 5.3 sits in the medium band despite limited direct impact.

No public proof-of-concept, Nuclei template, or exploit code was identified for CVE-2026-82213, and there is no patch evidence from any tracked source. The attack chain below is therefore described at the vulnerability-class level and must not be read as a confirmed implementation.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the described vulnerability class (authorization bypass / IDOR with signature disclosure). Steps:

1. Reconnaissance / target identification. The attacker identifies WordPress sites running the Nexi XPay Build plugin within the affected version range (7.6.1–7.6.2). Because the plugin registers client-side assets under its own directory, standard HTTP fingerprinting is sufficient. Shodan dorks such as http.html:"wp-content/plugins/nexi-xpay-build" and http.html:"nexi" "xpay" can be used for internet-scale discovery without touching the target.

2. Triggering the flaw class. The attacker locates the plugin's payment-token retrieval functionality and issues a crafted request that supplies a token reference the plugin should only serve to the owning customer. The defect is the absence of the ownership assertion between the supplied token and the current user, so an unauthenticated request is processed and returns another customer's stored card token reference. No authentication material, credentials, or session cookie is required per the CVSS vector (PR:N/UI:N).

3. Payload / execution method, at class level. The request carries a token identifier as its user-controlled key. Because the plugin neither validates ownership nor enforces authentication on the retrieval path, the response contains both the token reference and the accompanying authorization signature. Token references are frequently sequential or otherwise guessable identifiers; if so, an attacker can iterate candidate values to harvest multiple customers' tokens in bulk. No specific parameter names or endpoint paths are asserted here because they are not provided in the available advisory text.

4. Post-exploitation impact. Holding both a victim's token reference and a valid authorization signature, the attacker possesses the material necessary to attempt payment operations against the merchant/PSP integration. Success depends on controls outside the plugin — PSP token binding, single-use token semantics, and step-up authentication. Even where outright fraudulent charging is blocked, the attacker has obtained a durable, transferable data pairing that constitutes a significant privacy and PCI-scope exposure and can be chained with other techniques, sold, or used for follow-on fraud. There is no publicly reported in-the-wild exploitation at the time of writing.

Impact Assessment

• Confidentiality (Low, C:L): Disclosure of other customers' stored card token references and associated authorization signatures. Real-world harm is typically limited to personal data exposure rather than direct account takeover, but token-plus-signature pairs materially increase downstream fraud risk.
• Integrity (None, I:N): The vulnerability itself does not permit modification of data; any integrity impact would arise from successful downstream payment replay, which is outside the CVE's stated scope.
• Availability (None, A:N): No denial-of-service component.
• Attack surface: Network-exposed (AV:N). Exploitation complexity is low (AC:L), no privileges (PR:N) and no user interaction (UI:N). Unchanged scope (S:U) means impacts are confined to the plugin/WordPress deployment in question — but that scope includes every customer whose token can be enumerated.
• Blast radius: Any WordPress site running Nexi XPay Build 7.6.1 or 7.6.2 with a non-trivial customer base and stored tokens. Because exploitation is unauthenticated and scripted enumeration is feasible, the practical blast radius can be the entire stored token population of an affected merchant within minutes.
• Regulatory exposure: Stored payment credentials fall squarely within PCI DSS scope; unauthorized retrieval of card token references and signatures is likely to be a reportable incident under PCI DSS and applicable data-protection regimes.
• CVSS context: The 5.3 medium rating derives from maximum exploitability subscores partially offset by low confidentiality impact and nil integrity/availability impact.

Detection Guidance

Detection is complicated by the absence of public exploit details and a published patch: legitimate and malicious requests to the token-retrieval path can look identical. The following rules therefore target behavioural signals — unauthenticated or high-volume token enumeration, anomalous request volumes on payment endpoints, and unusual POST/GET patterns against the WordPress plugin/API surface — rather than a fixed signature. Analysts must tune thresholds against their own normal plugin traffic baseline.

Sigma Rule

title: Potential Nexi XPay Build Saved Payment Token Enumeration (CVE-2026-82213)
id: 8e2b1a44-6c7e-4a91-9f3c-2d5b7c1f9a01
status: experimental
description: Detects repeated unauthenticated or enumeration-like requests to WordPress payment-token retrieval endpoints that may indicate exploitation of the missing ownership check in Nexi XPay Build 7.6.1-7.6.2.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-82213
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_paths:
    - '*/wp-content/plugins/nexi-xpay-build/*'
    - '*/wp-json/nexi-xpay-build/*'
    - '*/admin-ajax.php*'
  selection_method:
    - 'GET'
    - 'POST'
  selection_keywords:
    - 'token'
    - 'payment'
    - 'nexi'
  filter_static:
    cs-uri-query|contains: '.css'
  condition: (selection_paths or selection_keywords) and selection_method and not filter_static
  timeframe: 5m
fields:
  - c-ip
  - cs-uri
  - cs-method
  - cs-user-agent
falsepositives:
  - Legitimate checkout traffic from returning customers
  - Plugin update or health-check requests
level: medium
tags:
  - attack.t1190
  - cve.2026.82213

YARA Rule

rule CVE_2026_82213_Nexi_XPay_Token_Exposure
{
    meta:
        description = "Detects sources referencing Nexi XPay Build versions in the CVE-2026-82213 affected range (7.6.1-7.6.2) within web-accessible content"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-82213"
        author      = "valtersit.com"
        date        = "2026-01-01"
        severity    = "medium"

    strings:
        $plugin = "nexi-xpay-build" nocase
        $xpay   = "nexi xpay build" nocase
        $ver1   = "7.6.1"
        $ver2   = "7.6.2"
        $wp     = "wp-content/plugins/" nocase

    condition:
        (uint16(0) == 0x8B1F or true) and
        (($plugin or $xpay) and $wp) and ($ver1 or $ver2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82213 Nexi XPay Build Saved Token Retrieval Request Attempted"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"nexi-xpay-build"; nocase; http.uri; content:"token"; nocase; reference:cve,2026-82213; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-82213; classtype:attempted-user; sid:8221301; rev:1;)

alert http any any -> any any (msg:"CVE-2026-82213 Nexi XPay Build Token Endpoint Access (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"nexi-xpay-build"; nocase; http.uri; pcre:"/(token|payment|retrieve)/i"; reference:cve,2026-82213; classtype:attempted-user; sid:8221302; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where network.protocol == "http"
      and http.request.method in ("GET", "POST")
      and stringContains(url.full, "nexi-xpay-build")
      and network.direction == "ingress" ]
  [ network where network.protocol == "http"
      and http.request.method in ("GET", "POST")
      and stringContains(url.full, "nexi-xpay-build")
      and stringContains(url.full, "token")
      and network.direction == "ingress" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval path=lower(uri)
| where (match(path, "nexi-xpay-build") OR match(path, "admin-ajax\.php") OR match(path, "wp-json/nexi"))
| where match(path, "(token|payment|retrieve)")
| stats count AS req_count, dc(uri) AS distinct_uris, values(method) AS methods, values(useragent) AS uas
        by src_ip
| where req_count > 20 OR distinct_uris > 10
| sort - req_count
| table src_ip, req_count, distinct_uris, methods, uas

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-82213">
  <rule id="822130" level="10" frequency="10" timeframe="120">
    <if_matched_sid>31100</if_matched_sid>
    <match>nexi-xpay-build</match>
    <match>token</match>
    <description>Possible CVE-2026-82213: repeated Nexi XPay Build payment token retrieval requests (possible unauthenticated enumeration)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_82213,payment_data_access,</group>
  </rule>

  <rule id="822131" level="12">
    <if_sid>822130</if_sid>
    <same_source_ip />
    <description>CVE-2026-82213: high-volume token retrieval from same source IP (likely automated exploitation)</description>
    <group>cve_2026_82213,exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No patch evidence exists from any tracked source, no vendor fix or workaround is documented, and no fixed version has been published. Treat affected installations as vulnerable until an official update ships.

1. Immediate mitigations (no official patch available):

• If the plugin is not strictly required for business operations, deactivate and remove Nexi XPay Build 7.6.1 / 7.6.2 from all WordPress sites.
• Where the plugin must remain active, place the payment-token retrieval path behind authentication or a WAF rule and restrict access to expected sources only. This is a compensating control, not a fix — the underlying missing ownership check remains.
• Disable or harden any unauthenticated public endpoints the plugin exposes. Audit the plugin for AJAX/REST handlers that return token or signature data and require a valid user session plus an ownership assertion before returning data.
• Review PSP-side configuration: enable binding of tokens to the customer, enforce single-use or short-lifetime token semantics, and require step-up/3-D Secure authentication for any payment operation using a stored token.
• Rotate or invalidate any stored payment token references in scope as a precaution if exploitation is suspected, coordinating with the payment service provider.
• Increase monitoring on the plugin's request paths and treat anomalous token-retrieval volume as a potential incident.

2. Patch / upgrade steps:

• Monitor the Nexi XPay Build plugin changelog, the WordPress.org plugin repository, and Nexi's official advisories for a fixed release. No fixed version is known at this time; the affected range is 7.6.1 through 7.6.2.
• Once a fix is published, upgrade immediately, verify the version, and re-test the token-retrieval path to confirm the ownership check is enforced.
• Until then, if the maintainer offers a beta/hotfix, validate it in staging before production, expressly checking that unauthenticated token retrieval returns an authorization error.

3. Long-term hardening:

• Require object-level authorization on every server-side operation that acts on a user-controllable key (CWE-639 class): validate that the requested object belongs to the authenticated principal before returning it.
• Adopt a secure-by-design review for all payment and customer-data endpoints: default-deny, explicit ownership checks, and no reliance on obscurity of token identifiers.
• Add automated dependency and WordPress-plugin vulnerability scanning (e.g., WPScan-style) with alerting on new CVEs for installed components.
• Segment and log payment integrations; ensure PCI DSS scoped logging and alerting on access to stored token material.
• Enforce token randomization and non-guessable identifiers so enumeration is impractical even if an authorization check regresses.

References

• NVD — CVE-2026-82213: https://nvd.nist.gov/vuln/detail/CVE-2026-82213
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• CVSS v3.1 Specification (FIRST.org): https://www.first.org/cvss/v3.1/specification-document
• WordPress Plugin Security / Hardening guidance: https://developer.wordpress.org/plugins/security/
• PCI Security Standards Council — PCI DSS (token and stored-credential requirements): https://www.pcisecuritystandards.org/

Threat actor / exploit-in-the-wild note: CISA KEV status is NO, no public PoC, no Nuclei template, and no exploit code was observed at the time of writing. No threat actor campaign has been attributed to CVE-2026-82213. The absence of a patch makes weaponization plausible; defenders should treat this as an emerging, unpatched exposure and monitor for the first public exploit.