PatchTheCVECVE-2020-8819: An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce
CVE-2020-8819 is a high-severity flaw (CVSS 8.1) affecting cardgate payments. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or r
Why this priority
- High severity
- EPSS top 8%: very likely to be exploited
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 4.9% (top 8%) |
| CISA exploited list | No |
| Weakness | CWE-346 |
| Published | 2020-02-25 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-8819?
cardgate payments: upgrade to newer than 3.1.15. Exact commands for each OS are on this page.
Is CVE-2020-8819 being exploited?
CVE-2020-8819 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-8819 affect?
CVE-2020-8819 affects cardgate payments. Severity is high (CVSS 8.1). An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin se
How urgent is CVE-2020-8819?
Priority 56/100. High severity; EPSS top 8%: very likely to be exploited; Public exploit reference
Software pages
PHP vulnerabilities · WooCommerce vulnerabilities
Related CVEs
- CVE-2020-8818 HIGH 8.1 UPGRADE DOWNGRADE An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2