EIP-2026-109242

This exploit demonstrates a lack of origin authentication in the CardGate Payment Gateway for Magento, allowing an attacker to replace critical plugin settings (merchant ID, secret key) via a crafted IPN callback request. It can spoof order statuses or redirect payments to an attacker-controlled account.