Dear Customer,
We would like to inform you that critical security vulnerabilities affecting WHMCS have been identified. Hotfixes are now available. All vulnerabilities addressed in this release were identified internally through our security review process. We are not aware of any exploitation of these vulnerabilities.
1. Unauthenticated disclosure of customer data via 2Checkout: CVE-2026-67398
Situation: An unauthenticated user could potentially access customers’ personal data through the 2Checkout payment gateway integration under specific conditions.
Impact: Enumeration of invoice IDs and retrieval of customers’ personal data.
Affected Versions:
• All WHMCS 9.x builds prior to 9.0.8
• All WHMCS 8.x builds prior to 8.13.7
• WHMCS 4.5 and later (all versions in this range require upgrading)
Patched Versions:
• WHMCS 9.0.8
• WHMCS 8.13.7
Support Link: https://help.whmcs.com/m/125386/l/2116695-cve-2026-67398-whmcs-security-update-2026-09-03
2. Vulnerability in WHMCS allows unauthenticated remote code execution via a multistage request/deserialization chain: CVE-2026-67399
Situation: An unauthenticated user can submit a forged payload that is deserialized without adequate restrictions, leading to remote code execution on the server.
Impact: An unauthenticated attacker could leverage this object-injection flaw to execute arbitrary code on the WHMCS host, resulting in full compromise of the installation and its data.
Affected Versions:
• All WHMCS 9.x builds prior to 9.0.8
• All WHMCS 8.x builds prior to 8.13.7
Patched Versions:
• WHMCS 9.0.8
• WHMCS 8.13.7
Support Link: https://help.whmcs.com/m/125386/l/2118034-cve-2026-67399-whmcs-security-update-2026-09-03
Action Required:
Update WHMCS Now
1. Log into your WHMCS Admin Area.
2. Go to Utilities > Update WHMCS.
3. Install the latest update to version 8.13.7 (8.13.x branch) or 9.0.8 (9.0.x branch). This single update addresses all issues listed above.
4. Verify the installed version in the Admin Area footer or under Utilities > System Health Status.
Mitigation
1. Issue 1: If you use the 2Checkout payment gateway: Until you can apply the update, deactivate the 2Checkout gateway to block the vulnerable endpoint.
2. Issue 1: If you do not use 2Checkout: No immediate workaround is required, but we still recommend applying the update promptly.
3. Issue 2: There is no customer-side workaround; applying the update is the only remediation.
Please reach out to our support team if you have any questions or need further guidance.
We would like to inform you that critical security vulnerabilities affecting WHMCS have been identified. Hotfixes are now available. All vulnerabilities addressed in this release were identified internally through our security review process. We are not aware of any exploitation of these vulnerabilities.
1. Unauthenticated disclosure of customer data via 2Checkout: CVE-2026-67398
Situation: An unauthenticated user could potentially access customers’ personal data through the 2Checkout payment gateway integration under specific conditions.
Impact: Enumeration of invoice IDs and retrieval of customers’ personal data.
Affected Versions:
• All WHMCS 9.x builds prior to 9.0.8
• All WHMCS 8.x builds prior to 8.13.7
• WHMCS 4.5 and later (all versions in this range require upgrading)
Patched Versions:
• WHMCS 9.0.8
• WHMCS 8.13.7
Support Link: https://help.whmcs.com/m/125386/l/2116695-cve-2026-67398-whmcs-security-update-2026-09-03
2. Vulnerability in WHMCS allows unauthenticated remote code execution via a multistage request/deserialization chain: CVE-2026-67399
Situation: An unauthenticated user can submit a forged payload that is deserialized without adequate restrictions, leading to remote code execution on the server.
Impact: An unauthenticated attacker could leverage this object-injection flaw to execute arbitrary code on the WHMCS host, resulting in full compromise of the installation and its data.
Affected Versions:
• All WHMCS 9.x builds prior to 9.0.8
• All WHMCS 8.x builds prior to 8.13.7
Patched Versions:
• WHMCS 9.0.8
• WHMCS 8.13.7
Support Link: https://help.whmcs.com/m/125386/l/2118034-cve-2026-67399-whmcs-security-update-2026-09-03
Action Required:
Update WHMCS Now
1. Log into your WHMCS Admin Area.
2. Go to Utilities > Update WHMCS.
3. Install the latest update to version 8.13.7 (8.13.x branch) or 9.0.8 (9.0.x branch). This single update addresses all issues listed above.
4. Verify the installed version in the Admin Area footer or under Utilities > System Health Status.
Mitigation
1. Issue 1: If you use the 2Checkout payment gateway: Until you can apply the update, deactivate the 2Checkout gateway to block the vulnerable endpoint.
2. Issue 1: If you do not use 2Checkout: No immediate workaround is required, but we still recommend applying the update promptly.
3. Issue 2: There is no customer-side workaround; applying the update is the only remediation.
Please reach out to our support team if you have any questions or need further guidance.
