AI description
CVE-2026-67399 is a security vulnerability identified in WHMCS versions 8.0.x and later. This flaw involves the submission of forged payloads without sufficient restrictions, which, under specific conditions, can enable an attacker to achieve remote code execution on the server. The vulnerability impacts all WHMCS 9.x builds prior to version 9.0.8 and all WHMCS 8.x builds prior to version 8.13.7.
- Description
- Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.
- Source
- support@hackerone.com
- NVD status
- Deferred
CVSS 4.0
- Type
- Secondary
- Base score
- 9.3
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- CRITICAL
- support@hackerone.com
- CWE-502
- Hype score
- Not currently trending
Warning: A critical deserialisation flaw in #WHMCS allows unauthenticated remote code execution (CVE-2026-67399, CVSS(4.0): 9.3). A high 2Checkout gateway flaw exposes client PII (CVE-2026-67398, CVSS(4.0): 8.2). Read the advisory https://t.co/ersVWhMtHQ and #Patch #Patch #Patch
@CCBalert
16 Sept 2026
233 Impressions
1 Retweet
0 Likes
0 Bookmarks
0 Replies
0 Quotes
WebPros patches two flaws in WHMCS billing platform. CVE-2026-67399 enables unauthenticated RCE via unsafe deserialization (CVSS 9.3 Critical). CVE-2026-67398 in the 2CheckOut module allows unauthenticated access to customer PII due to missing authorization (CVSS 8.2 High).
@WorldCyberNewsX
15 Sept 2026
3 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
A critical WHMCS security update fixes CVE-2026-67399 and CVE-2026-67398. Apply the patch now to prevent remote code execution and data leaks. #WHMCS #CyberSecurity #CVE202667399 #CVE202667398 #InfoSec https://t.co/LuCYwv3icN https://t.co/BNvTvGIUBc
@Daily_CyberSec
4 Sept 2026
652 Impressions
3 Retweets
6 Likes
1 Bookmark
1 Reply
0 Quotes
🔴 WHMCS'te kritik güvenlik açıkları: CVE-2026-67398 & CVE-2026-67399 WHMCS, bugün iki güvenlik açığı için acil güncelleme yayınladı. 🚨 CVE-2026-67399 Kimlik doğrulaması gerektirmeyen bir saldırgan, özel hazırlanmış bir payload ve deserialization z
@ridvanyagli
3 Sept 2026
1282 Impressions
2 Retweets
17 Likes
5 Bookmarks
0 Replies
0 Quotes