CVE-2020-8819
High
Description
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
SeverityHigh
CVSS8.1
Exploit probability—
ProductCardgate Payments
PublishedFeb 25, 2020
First seenFeb 25, 2020
How to fix
Update
- cardgate/woocommerce3.1.16 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cardgate cardgate_payments | v ≤ 3.1.15 | — |
| cardgate/woocommercePackagist | v < 3.1.16 | 3.1.16 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.