Description

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-11T11:16:54.957Z",
  "pubdate": "2026-09-11T11:16:54.957Z",
  "executiveSummary": "The Nexi XPay Build WordPress plugin, specifically versions 7.6.1 through 7.6.2, contains a critical broken access control vulnerability. This security flaw stems from a lack of proper ownership verification when processing requests for stored payment tokens. An unauthenticated attacker can leverage this oversight to retrieve sensitive payment token references and valid authorization signatures belonging to other customers.\nThe vulnerability poses a significant risk to data confidentiality and payment security within the WordPress ecosystem. By bypassing authorization checks, unauthorized actors can access information that should be restricted to the authenticated account owner. The impact includes the potential for unauthorized access to transaction data and the compromise of payment-related identifiers. The exploit does not require prior authentication, significantly increasing the attack surface and potential for automated abuse. Organizations utilizing the affected versions of the Nexi XPay Build plugin are encouraged to prioritize remediation to prevent the unauthorized exposure of customer financial metadata.",
  "technicalDetails": "The root cause of this vulnerability is an Insecure Direct Object Reference (IDOR) pattern existing within the payment token retrieval logic of the Nexi XPay Build plugin. The application fails to validate the association between the authenticated session or the requesting user context and the requested payment token identifier. Consequently, the backend logic treats incoming requests for token retrieval as implicitly trusted, provided the request structure meets the minimum required input parameters.\nThe exploitation flow begins when an unauthenticated attacker identifies the endpoint responsible for fetching stored payment tokens. Because the plugin does not enforce a server-side check to verify that the user requesting the token is the legal owner of that specific payment profile, the attacker can manipulate request parameters—such as sequential IDs or brute-forceable token references—to iterate through the database of stored card tokens. By crafting these requests, the attacker triggers the vulnerable function to fetch the requested record.\nUpon successful execution of the request, the application returns sensitive data, including the payment token and a valid authorization signature. This signature is critical, as it signifies that the payload returned is valid for subsequent operations within the Nexi XPay gateway. The lack of an authentication requirement ensures that this process can be performed remotely over the network without any interaction from the legitimate owner of the payment information.\nThe affected component is the internal token management module of the Nexi XPay Build plugin, versions 7.6.1 through 7.6.2. The lack of a session-bound lookup table or an ownership validation wrapper allows the application to leak data cross-account. Post-exploitation, an attacker gains access to valid payment reference material, which could potentially be used in further malicious activities, such as fraudulent transaction initiation or additional data exfiltration, depending on the secondary validation logic present in the connected payment gateway API."
}