CVE-2026-54810: 
WordPress vulnerability analysis and mitigation

CVE-2026-54810 is a Missing Authorization (Broken Access Control) vulnerability in the Nexi XPay WordPress plugin by Nexi Payments, affecting all versions through 8.3.1. The flaw allows unauthenticated network attackers to exploit incorrectly configured access control security levels, resulting in a denial-of-service condition. It was discovered by researcher hivesec, reported on February 19, 2026, and publicly disclosed on June 17, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Patchstack, Github Advisory).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks when an actor attempts to access a resource or perform a privileged action. An unauthenticated remote attacker can invoke functionality that should be restricted, exploiting incorrectly configured access control security levels within the plugin. No privileges or user interaction are required, and the attack complexity is low, making it trivially automatable over the network. No public technical write-up or proof-of-concept code has been identified at this time (Patchstack, Github Advisory).

Successful exploitation results in a high-severity availability impact, allowing an unauthenticated attacker to disrupt the Nexi XPay payment plugin's functionality on affected WordPress sites. There is no confidentiality or integrity impact identified; the primary risk is denial of service to the payment processing capability, which could disrupt e-commerce operations for merchants relying on the plugin. The scope is unchanged, meaning the impact is confined to the vulnerable component itself (Patchstack, Github Advisory).

The vulnerability is patched in Nexi XPay version 8.3.2; administrators should update the plugin immediately from the WordPress plugin repository. Patchstack has also issued a virtual patching/mitigation rule for its users to block exploitation attempts until the plugin is updated. If an immediate update is not possible, site owners should consult their hosting provider or web developer, and consider temporarily disabling the plugin to prevent exploitation (Patchstack).

Wordfence included CVE-2026-54810 in its weekly WordPress vulnerability report for the period of June 15–21, 2026, highlighting it as part of broader WordPress plugin security coverage. Patchstack, which coordinated the disclosure, classified the vulnerability as high priority and noted that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability aggregator reporting.