CVE-2026-67398highCWE-862

CVE-2026-67398: high-severity vulnerability in WebPros WHMCS

Published · Updated

Follow this CVE+ Monitor WHMCS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.5%
Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
WebPros · WHMCS
Related CVEs — WebPros WHMCS

In the same product, most dangerous first.

CVE-2026-67399CRITICALCVE-2026-67399EPSS 0.8%CVE-2026-29204CRITICALCVE-2026-29204EPSS 0.3%