-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cardgate/woocommerce | composer | <= 3.1.15 | 3.1.16 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from the cardgate_callback function in cardgate.php (lines 426-442 in the pre-patch version). This function processes incoming 'cgp_sitesetup' requests by invoking pullConfig with attacker-controlled $_REQUEST parameters. The lack of origin validation (e.g., IP checks, HMAC signatures, or CSRF tokens) allows unauthorized parties to submit malicious configuration updates. The patch in commit 0b83588 modifies this flow by introducing proper authentication checks, confirming this was the vulnerable code path. The exploit PoC specifically targets this endpoint to overwrite merchant settings, demonstrating the function's insecure implementation.
KEV Misses 88% of Exploited CVEs- Get the report