High severity · published Apr 10, 2025
CVE-2025-32119
WordPress CardGate Payments for WooCommerce plugin <= 3.2.1 - SQL Injection vulnerability
8.2
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CardGate CardGate Payments for WooCommerce cardgate allows Blind SQL Injection.This issue affects CardGate Payments for WooCommerce: from n/a through <= 3.2.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CardGate Payments for WooCommerce · CardGate
through 3.2.1 · source: vendor
Affected product
CP
CardGate Payments for WooCommerce
CardGate
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-32119
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-32119
patchstack.com
https://patchstack.com/database/Wordpress/Plugin/cardgate/vulnerability/wordpress-cardgate-payments-for-woocommerce-plugin-3-2-1-sql-injection-vulnerability?_s_id=cve
More from CardGate Payments for WooCommerce
6.1
CVE-2024-12257
CardGate Payments for WooCommerce <= 3.2.1 - Reflected Cross-Site Scripting