CVE-2020-8819 EXPLOIT
8.1
HIGH · CVSS 3.1 · EPSS 4.9% (pctl 92)
Patch early
A public exploit exists.
Description
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
Scoring
| CVSS | 8.1 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| EPSS | 4.88% — more likely to be exploited than 92% of all CVEs |
| Weakness | CWE-346 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2020-02-25 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| cardgate | cardgate payments |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | WordPress Plugin WooCommerce CardGate Payment Gateway 3.1.15 - Payment Process Bypass | 2020-02-25 |
References
- http://packetstormsecurity.com/files/156504/WordPress-WooCommerce-CardGate-Payment-Gateway-3.1.15-Bypass.html
- https://github.com/cardgate/woocommerce/blob/f2111af7b1a3fd701c1c5916137f3ac09482feeb/cardgate/cardgate.php#L426-L442
- https://github.com/cardgate/woocommerce/issues/18
- https://wpvulndb.com/vulnerabilities/10097
- https://www.exploit-db.com/exploits/48134
- http://packetstormsecurity.com/files/156504/WordPress-WooCommerce-CardGate-Payment-Gateway-3.1.15-Bypass.html
- https://github.com/cardgate/woocommerce/blob/f2111af7b1a3fd701c1c5916137f3ac09482feeb/cardgate/cardgate.php#L426-L442
- https://github.com/cardgate/woocommerce/issues/18
- https://wpvulndb.com/vulnerabilities/10097
- https://www.exploit-db.com/exploits/48134
→ the Explorer · watch your stack · NVD