CVE-2026-67399 – WebPros WHMCS
CVSS 9.3
CRITICAL
[2] Critical – Same Day Deployment
“One poisoned request is all it takes to hand attackers the keys to your billing platform and every customer account inside it.”
This WHMCS update fixes a critical deserialization flaw that lets remote attackers execute arbitrary code on the server. CVE-2026-67399 has a CVSS score of 9.3, Critical severity. WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 are affected, and the fixed releases close the gap.
WHMCS runs billing, client management, and provisioning for hosting providers, so a compromise exposes customer records, payment workflows, and connected server infrastructure. Upgrade to 9.0.8 or 8.13.7 without delay.
Key Details
- CWE Classification
- CWE-502
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.