First of all, I am not a lawyer, and I am not giving legal advice.
I'm not sure if it is technically illegal (it would not surprise me, either way), but if you are accepting and storing a credit card number on a non-secure server, it is against Visa/MasterCard policy (and I'm sure the policy of numerous other credit card processors), and I would assume most merchants have similar policies.
If you are not storing the credit card number, though, and are instead only passing the data from your website to your processor, it's generally accepted that a shared environment server is OK, as long as it is using SSL.