WHMCS vulnerabilities

2 known vulnerabilities in WHMCS from WebPros. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  WHMCS: Missing Authorization

  CVE-2026-67398Sep 4, 2026WebPros

  Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data v

• 9.1 Critical severity

  WHMCS: Authorization Bypass Through User-Controlled Key

  CVE-2026-29204May 12, 2026WebPros

  Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation leading to unauthorized access to the victim's account.