High severity · published Sep 3, 2026
CVE-2026-67398
Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0
8.2
CVSS
0.5%
EPSS
No
On KEV
Description
Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WH
WHMCS · WebPros
4.5.0 before 8.12.2; 8.13.0 before 8.13.7; 9.0.0 before 9.0.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67398
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67398
help.whmcs.com
https://help.whmcs.com/m/125386/l/2116695-cve-2026-67398-whmcs-security-update-2026-09-03
More from WHMCS
9.3
CVE-2026-67399
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code
9.1
CVE-2026-29204
Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation…