The vulnerability stems from the cardgate_callback function in cardgate.php (lines 426-442 in the pre-patch version). This function processes incoming 'cgp_sitesetup' requests by invoking pullConfig with attacker-controlled $_REQUEST parameters. The lack of origin validation (e.g., IP checks, HMAC signatures, or CSRF tokens) allows unauthorized parties to submit malicious configuration updates. The patch in commit 0b83588 modifies this flow by introducing proper authentication checks, confirming this was the vulnerable code path. The exploit PoC specifically targets this endpoint to overwrite merchant settings, demonstrating the function's insecure implementation.