CVE-2026-82213 is an authorization bypass vulnerability in the Nexi XPay Build WordPress plugin versions 7.6.1 and 7.6.2. The plugin does not properly verify ownership of saved payment tokens when they are requested, enabling unauthenticated attackers to access other users' stored card token references with a valid authorization signature. This issue is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). No patch or remediation details are provided in the available data.

An unauthenticated attacker can retrieve stored card token references belonging to other customers. This exposure could lead to unauthorized access to sensitive payment token data, potentially facilitating fraudulent transactions or further attacks. The confidentiality of stored payment tokens is compromised, but integrity and availability are not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's endpoints and monitor for suspicious activity related to payment token requests. Avoid exposing saved payment token references to unauthenticated users.