Quick answers
- Is CVE-2026-82213 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82213 being exploited in the wild.
- How severe is CVE-2026-82213?
- Medium severity, with a CVSS score of 5.3, published 11 September 2026.
- Which products and versions are affected?
- Nexi XPay Build 7.6.1–7.6.2.
- Is there a fix for CVE-2026-82213?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82213 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-82213?
- Check whether you run Nexi XPay Build at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The plugin contains an insecure direct object reference (IDOR) vulnerability in the build_payment_payload AJAX action. The vulnerability exists because the token_id parameter is not validated to ensure it belongs to the currently logged-in user, and no authentication check is enforced. An unauthenticated attacker can enumerate sequential token identifiers (1, 2, 3, etc.) to discover all saved payment tokens in the store and retrieve each token's reference, transaction code, timestamp, and server-signed authorization signature. The attacker can craft requests using their own cart amount, meaning the signed payload is valid for any transaction value they choose. The plugin applies no gateway filter, so tokens saved for different payment methods are all disclosed equally.
Affected products
- Nexi XPay Build 7.6.1–7.6.2
Timeline
- 2026-09-08: disclosed
- 2026-09-11: advisory