Compliance Impact

The vulnerability in Nexi XPay Plugin allows unauthenticated attackers to perform privileged actions due to missing authorization checks, which constitutes broken access control.

Such broken access control issues can lead to unauthorized access or disruption of services, potentially resulting in data breaches or service unavailability.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, vulnerabilities that allow unauthorized access or denial of service can negatively impact compliance by risking the confidentiality, integrity, and availability of sensitive data.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-54810 is a Missing Authorization vulnerability in the Nexi Payments Nexi XPay WordPress plugin, versions 8.3.1 and below.

This vulnerability is a Broken Access Control issue that allows unauthenticated attackers to perform privileged actions because the plugin lacks proper authorization checks.

It is classified as a high-priority security flaw with a CVSS score of 7.5 and falls under the OWASP Top 10's A1 category.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a significant impact as it allows attackers without any authentication to perform privileged actions on affected websites using the Nexi XPay plugin.

Such unauthorized actions could lead to disruption of services or compromise of the affected system's availability.

The vulnerability is actively exploited in mass campaigns targeting thousands of websites, increasing the risk of widespread damage.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability allows unauthenticated attackers to perform privileged actions due to missing authorization checks in the Nexi XPay WordPress plugin versions 8.3.1 and below.

Detection can involve monitoring for unusual or unauthorized access attempts to the Nexi XPay plugin endpoints, especially those that should require authorization.

Since the vulnerability is related to broken access control, network or system detection could include checking web server logs for suspicious requests targeting the plugin's API or admin functions without proper authentication.

Specific commands are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate recommended step is to update the Nexi XPay WordPress plugin to version 8.3.2 or later, where the vulnerability is patched.

Until the update can be applied, Patchstack provides an automatic mitigation rule that can be used to block attacks targeting this vulnerability.

Users should also monitor their systems for any signs of exploitation and restrict access to the plugin's administrative functions where possible.

Useful 0 Not Useful 0