What is the CVSS score of CVE-2026-54810?

CVE-2026-54810 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Nexi XPay are affected by CVE-2026-54810?

The Nexi XPay WordPress plugin (versions through 8.3.1) allows unauthenticated attackers to access payment processing endpoints without authorization.

How to fix or mitigate CVE-2026-54810?

Within 24 hours: Audit all WordPress installations for Nexi XPay versions ≤8.3.1 and document exposure scope; prioritize merchant sites processing transactions. Within 7 days: Deploy firewall rules restricting payment endpoint access to known/approved IP ranges; implement Web Application Firewall blocking unauthorized requests to affected endpoints. Within 30 days: Monitor Nexi and Patchstack advisories for patched version release; establish timeline to upgrade or migrate to alternative payment processor; complete compensating control deployment across all affected instances.

Nexi XPay CVE-2026-54810

HIGH

Missing Authorization (CWE-862)

2026-06-17 Patchstack

WordPress Authentication Bypass Wordpress Plugin Nexi Xpay

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable WordPress plugin endpoint with missing authorization (AV:N/AC:L/PR:N/UI:N); description and scorer constrain impact to availability only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 15:33 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Nexi XPay: from n/a through 8.3.1.

AnalysisAI

Missing authorization in the Nexi XPay WordPress plugin (versions up to and including 8.3.1) allows remote unauthenticated attackers to exploit incorrectly configured access control security levels, resulting in high impact to availability. Reported by Patchstack with no public exploit identified at time of analysis, the issue stems from broken access control on plugin endpoints used by Italian e-commerce sites integrating Nexi/CartaSi payment processing.

Technical ContextAI

Nexi XPay (formerly CartaSi XPay) is a WordPress plugin that integrates Nexi Payments' XPay gateway - a widely used Italian payment processor - into WooCommerce and similar stores to handle credit card transactions. The root cause is CWE-862 (Missing Authorization): one or more plugin-exposed actions, AJAX handlers, or REST routes execute privileged operations without verifying that the caller is authorized via WordPress capability checks (current_user_can) or nonce validation. The affected CPE cpe:2.3:a:nexi_payments:nexi_xpay covers all versions through 8.3.1, and Patchstack categorizes the flaw as a Broken Access Control / Authentication Bypass issue on the WordPress plugin attack surface.

RemediationAI

No vendor-released patched version is identified in the available data - the Patchstack record only marks 8.3.1 as vulnerable without naming a fixed release, so administrators should monitor the plugin's WordPress.org changelog and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/cartasi-x-pay/vulnerability/wordpress-nexi-xpay-plugin-8-3-1-broken-access-control-vulnerability) for a 8.3.2 or later update and upgrade as soon as it ships. As compensating controls until a fix lands, deploy a WAF rule (Patchstack, Wordfence, or equivalent) that blocks unauthenticated requests to the plugin's admin-ajax actions and REST routes under /wp-json/ associated with the cartasi-x-pay slug; restrict /wp-admin/admin-ajax.php and the plugin's endpoint paths to known IPs via webserver ACLs if your store traffic pattern allows it (trade-off: may break legitimate checkout callbacks from Nexi, so test the payment flow afterwards); and if the site is non-production or the plugin is rarely used, temporarily deactivate it, accepting that card payments via Nexi XPay will be disabled.