CVE-2026-67398

WebPros / WHMCS PUBLISHED

Description (CNA)

Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.

Affected (CNA)

Vendor / product	Versions
WebPros / WHMCS	affected 4.5.0 before 8.12.2; affected 8.13.0 before 8.13.7; affected 9.0.0 before 9.0.8

CWE

CWE-862

References

https://help.whmcs.com/m/125386/l/2116695-cve-2026-67398-whmcs-security-update-2026-09-03

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.