CVE-2026-16272
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A use of less trusted source vulnerability in the PayTR Virtual Pos iFrame API WHMCS Module allows exploitation of trusted identifiers. This issue affects versions from v9.0.0 before v9.0.3.
Risk Assessment
Exploitation of trusted identifiers can lead to unauthorized transactions or disclosure of payment data. The risk is high in e-commerce environments processing payments.
Recommendation
Upgrade the PayTR Virtual Pos iFrame API WHMCS Module to v9.0.3 or later. Also verify transaction identifier integrity on the server side.
Other vulnerabilities in PayTR Virtual Pos iFrame API WHMCS Module
See all- CVE-2026-16037High
The PayTR Virtual Pos iFrame API WHMCS Module contains an observable timing discrepancy vulnerability, allowing black box reverse engineering. The issue affects versions from v9.0.0 before v9.0.3.
- CVE-2026-16025High
The PayTR Virtual Pos iFrame API WHMCS Module contains a vulnerability due to improper validation of specified quantity in input, allowing input data manipulation. The issue affects versions from v9.0.0 before v9.0.3.
Original NVD description (English source)
Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS