What’s Vulnerable › Vulnerabilities

CVE-2020-8819

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-02-25 · updated 2026-06-17
• Weakness: CWE-346

Description

An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.

Affected products

• Cardgate Payments: through 3.1.15

References

• http://packetstormsecurity.com/files/156504/WordPress-WooCommerce-CardGate-Payment-Gateway-3.1.15-Bypass.html
• https://github.com/cardgate/woocommerce/blob/f2111af7b1a3fd701c1c5916137f3ac09482feeb/cardgate/cardgate.php#L426-L442
• https://github.com/cardgate/woocommerce/issues/18
• https://wpvulndb.com/vulnerabilities/10097
• https://www.exploit-db.com/exploits/48134
• http://packetstormsecurity.com/files/156504/WordPress-WooCommerce-CardGate-Payment-Gateway-3.1.15-Bypass.html
• https://github.com/cardgate/woocommerce/blob/f2111af7b1a3fd701c1c5916137f3ac09482feeb/cardgate/cardgate.php#L426-L442
• https://github.com/cardgate/woocommerce/issues/18
• https://wpvulndb.com/vulnerabilities/10097
• https://www.exploit-db.com/exploits/48134

Get alerted when CVE-2020-8819 or the next vulnerability affects your stack