CVE-2026-54810: Nexi XPay Auth Bypass Vulnerability

CVE-2026-54810 Overview

CVE-2026-54810 is a missing authorization vulnerability in the Nexi Payments Nexi XPay plugin for WordPress, also known as cartasi-x-pay. The flaw stems from incorrectly configured access control security levels, classified under [CWE-862]. All versions of Nexi XPay up to and including 8.3.1 are affected. Unauthenticated attackers can reach protected functionality over the network without user interaction. The issue impacts availability of the affected component, allowing remote actors to disrupt payment-related plugin operations on WordPress sites that integrate the Nexi XPay gateway.

Critical Impact
Remote, unauthenticated attackers can abuse broken access control in Nexi XPay through version 8.3.1 to impact site availability without privileges or user interaction.

Affected Products

Nexi Payments Nexi XPay WordPress plugin (cartasi-x-pay)
All versions from unspecified initial release through 8.3.1
WordPress installations using the Nexi XPay payment integration

Discovery Timeline

2026-06-17 - CVE-2026-54810 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54810

Vulnerability Analysis

The Nexi XPay plugin exposes one or more functions or endpoints without enforcing proper authorization checks. The plugin assumes a particular access context but does not validate the caller's permissions before executing sensitive logic. Attackers reach the vulnerable code path over the network without authenticating and without interacting with a legitimate user.

The weakness aligns with [CWE-862] Missing Authorization. Code paths that should be restricted to administrators, authenticated customers, or trusted callbacks are reachable by anonymous HTTP requests. Successful exploitation degrades availability of the plugin's functionality, which can disrupt checkout flows and payment processing on affected WordPress sites.

Root Cause

The root cause is an incorrectly configured access control security level on plugin handlers. The plugin omits or improperly applies capability checks such as current_user_can() and lacks nonce or signature validation on actions that change state or consume resources. As a result, authorization is effectively absent on code paths that require it.

Attack Vector

The attack vector is network-based with low complexity. An attacker sends crafted HTTP requests to WordPress endpoints registered by the Nexi XPay plugin, such as AJAX actions, REST routes, or admin-post handlers. Because no privileges or user interaction are required, automated scanners can identify and abuse vulnerable installations at scale.

No public proof-of-concept exploit code is referenced for this CVE. See the Patchstack WordPress Vulnerability Advisory for vendor-coordinated technical details.

Detection Methods for CVE-2026-54810

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to WordPress AJAX endpoints such as /wp-admin/admin-ajax.php referencing Nexi XPay actions.
Requests to plugin-specific REST routes or files under /wp-content/plugins/cartasi-x-pay/ from unknown source addresses.
Bursts of failed or anomalous checkout or callback transactions tied to the Nexi XPay integration.

Detection Strategies

Inventory WordPress sites and identify any running the Nexi XPay plugin at version 8.3.1 or earlier.
Inspect web server and WAF logs for repeated access to plugin endpoints without an authenticated session cookie.
Correlate plugin endpoint access with availability errors, timeouts, or 5xx responses on the WordPress host.

Monitoring Recommendations

Enable verbose access logging for /wp-admin/admin-ajax.php, /wp-json/, and plugin paths to support forensic review.
Alert on traffic spikes targeting Nexi XPay endpoints from a single source or distributed scanner infrastructure.
Monitor WordPress plugin file integrity and configuration changes on production e-commerce sites.

How to Mitigate CVE-2026-54810

Immediate Actions Required

Identify all WordPress sites running Nexi XPay at version 8.3.1 or earlier and prioritize them for patching.
Apply the fixed version released by Nexi Payments as soon as it is available through the WordPress plugin repository.
Restrict access to WordPress administrative endpoints and plugin paths with a web application firewall (WAF) rule set.

Patch Information

A fixed release should be obtained directly from Nexi Payments through the WordPress plugin repository for cartasi-x-pay. Refer to the Patchstack WordPress Vulnerability Advisory for the authoritative fixed version and remediation guidance.

Workarounds

Deactivate the Nexi XPay plugin on affected sites until a patched version is installed.
Deploy WAF rules to block unauthenticated requests to plugin-specific AJAX actions and REST routes.
Limit access to /wp-admin/ and plugin endpoints by source IP where business processes allow.

bash

# Example WAF/Nginx rule to restrict unauthenticated access to plugin paths
location ~* /wp-content/plugins/cartasi-x-pay/ {
    deny all;
    return 403;
}