CVE-2026-67398

HighCVSS 8.2

Published: 04/09/2026(UTC)Updated: 14/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

A missing authorization vulnerability has been discovered in the 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, and all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.

Risk Assessment

The risk includes unauthorized access to customer data, potentially leading to privacy breaches and leakage of sensitive information.

Recommendation

Update WHMCS to version 8.13.7 or 9.0.8 (or later) and review logs for unauthorized requests to the 2Checkout endpoint.

Other vulnerabilities in WHMCS

CVE-2026-67399Critical
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.

Original NVD description (English source)

Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.