VulnSocial

CVE-2026-67398Patch

LOWCVSS 8.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 3 signals
  • Peaked 2d ago at 1 mentions (2026-09-03); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-09-03: 1Mentions · 2026-09-04: 1Mentions · 2026-09-16: 1Patch / Workaround · 2026-09-03: 1Patch / Workaround · 2026-09-04: 1Patch / Workaround · 2026-09-16: 1Technical Details · 2026-09-03: 1Technical Details · 2026-09-04: 1Technical Details · 2026-09-16: 109-0309-0409-16
Signal classification1 categories
Patch
3100.0%
Referenced assets3 URLs
Full discourse3 posts
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🔴 WHMCS'te kritik güvenlik açıkları: CVE-2026-67398 & CVE-2026-67399 WHMCS, bugün iki güvenlik açığı için acil güncelleme yayınladı. 🚨 CVE-2026-67399 Kimlik doğrulaması gerektirmeyen bir saldırgan, özel hazırlanmış bir payload ve deserialization zincirini kullanarak WHMCS sunucusunda uzaktan kod çalıştırabiliyor (RCE). Başarılı istismar, WHMCS kurulumunun ve üzerindeki verilerin tamamen ele geçirilmesine yol açabilir. Etkilenen sürümler: • WHMCS 8.x -> 8.13.7 öncesi • WHMCS 9.x -> 9.0.8 öncesi 🚨 CVE-2026-67398 2Checkout entegrasyonundaki bir açık, kimlik doğrulaması olmayan saldırganların belirli koşullarda fatura ID'lerini enumerate ederek müşteri verilerine erişmesine neden olabiliyor. Bu açık için WHMCS 4.5 ve sonrası sürümler etkilenmiş olarak belirtiliyor. ✅ Önerilen sürümler: • 8.13.7 • 9.0.8 2Checkout kullanmıyorsanız CVE-2026-67398 için acil workaround gerekmiyor; ancak WHMCS'in kendisi güncellemenin mümkün olan en kısa sürede uygulanmasını öneriyor. ⚠️ Özellikle CVE-2026-67399 nedeniyle internete açık WHMCS 8.x/9.x kurulumlarının gecikmeden güncellenmesi gerekiyor. Kaynaklar: WHMCS Security Advisory, 3 Eylül 2026. https://help.whmcs.com/m/125386/l/2116695-cve-2026-67398-whmcs-security-update-2026-09-03 https://help.whmcs.com/m/125386/l/2118034-cve-2026-67399-whmcs-security-update-2026-09-03

    Post summary

    The advisory announces urgent updates for two CVEs, detailing exploitation methods and recommending specific patched versions without mentioning active attacks or exploit code.

    0201851.5K
    2.4K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    A critical WHMCS security update fixes CVE-2026-67399 and CVE-2026-67398. Apply the patch now to prevent remote code execution and data leaks. #WHMCS #CyberSecurity #CVE202667399 #CVE202667398 #InfoSec https://securityonline.info/whmcs-security-update-cve-2026-67399/ https://t.co/BNvTvGIUBc

    Post summary

    The post announces a critical WHMCS security update for CVE‑2026‑67399 and CVE‑2026‑67398, urging users to apply the patch to prevent remote code execution and data leaks.

    13071814
    13.0K followersView on X
  • CCB Alert@CCBalert
    Patch

    Warning: A critical deserialisation flaw in #WHMCS allows unauthenticated remote code execution (CVE-2026-67399, CVSS(4.0): 9.3). A high 2Checkout gateway flaw exposes client PII (CVE-2026-67398, CVSS(4.0): 8.2). Read the advisory https://help.whmcs.com/m/125386/l/2118034-cve-2026-67399-whmcs-security-update-2026-09-03 and #Patch #Patch #Patch

    Post summary

    The post discloses two critical WHMCS vulnerabilities (unauthenticated RCE via deserialization and PII exposure) and directs readers to a vendor security-update advisory with #Patch hashtags, but provides no PoC, exploit tool, or evidence of active exploitation.

    01000284
    7.3K followersView on X

Explore more

Back to dashboard