WHMCS published two security advisories on September 3. The more serious, CVE-2026-67399, lets an unauthenticated attacker submit forged payloads and, under conditions the vendor does not spell out, execute arbitrary code on the WHMCS host. The advisory says this could result in full compromise of the installation and its data, and that the vulnerable code has been present since WHMCS 8.0. The second, CVE-2026-67398, sits in the 2CheckOut payment gateway module and can, in circumstances the advisory does not detail, expose a client’s name, address, email and phone number to an unauthenticated user. Both are fixed in WHMCS 9.0.8 and 8.13.7, the company says, and the 2CheckOut advisory spells out what that means for anything older: the fix exists only for supported versions, so an installation on 8.0 through 8.12 has to upgrade.

Key facts as of September 4, 2026

  • CVE-2026-67399: unauthenticated remote code execution via forged payloads. According to the vendor, the vulnerable code has been present since WHMCS 8.0; all 8.x builds before 8.13.7 and all 9.x builds before 9.0.8 are affected. No CVE record had been published by the time of writing, so no CVSS score was available.
  • CVE-2026-67398: unauthenticated disclosure of client personal data through the 2CheckOut gateway module, affecting versions from 4.5.0. CVSS 4.0 score of 8.2, High, credited to a researcher known as boomerang, per the CVE record published the same day.
  • Fixed in, according to WHMCS: 9.0.8 and 8.13.7, listed in the official 9.0 and 8.13 change logs updated on September 3. The CVE record for the gateway flaw conflicts with the vendor’s documentation by listing 8.13 versions before 8.13.8 as affected.
  • Workaround: for the gateway flaw only, deactivate the 2CheckOut module and switch to another gateway.
  • Fifth in a row: every 9.0 maintenance release since 9.0.4 in May, which fixed CVE-2026-29204, a flaw rated 9.1, has carried security fixes, per the change log.

Forged Payloads, No Login Required

The advisory for CVE-2026-67399 is short and gives no technical detail beyond its one-sentence description: a vulnerability “involving the submission of forged payloads without adequate restrictions” that, “under specific conditions”, an attacker could use to reach remote code execution. The impact section is less guarded. An unauthenticated user, it says, could execute arbitrary code on the WHMCS host, “resulting in full compromise of the installation and its data”. For a system that holds a hosting company’s client records, invoices and payment details, that is the worst case in one sentence.

The flaw was disclosed through the company’s security program, according to the advisory, which does not name the reporter. The CVE record had not been published by the time of writing, so there is no CVSS score, no weakness classification and no independent description to set beside the vendor’s. Neither advisory says whether exploitation has been observed in the wild. What the vendor does state plainly is the affected range: all 9.x builds before 9.0.8 and all 8.x builds before 8.13.7, with the vulnerable code present since 8.0.

Nearly Two-Thirds of All-in-One WP Migration Installs Remain Unpatched Two Weeks Later

A Gateway Module That Answered Without Asking

The second flaw is better documented, because its CVE record went out through HackerOne on September 3. CVE-2026-67398 sits in the 2CheckOut payment gateway module, is classified as missing authorization, and is scored at 8.2 on the CVSS 4.0 scale. The advisory describes the result: an unauthenticated request to the module’s endpoint can return personally identifiable information for a client under specific conditions, listing name, address, city, state, postal code, country, email and phone number. The affected range starts at WHMCS 4.5.0.

This one has a workaround. Any installation that cannot update at once can deactivate the 2CheckOut module under payment gateways in the system settings and route payments through another gateway, which the advisory offers as a temporary workaround. One detail differs between the two documents: the CVE record lists WHMCS 8.13 versions before 8.13.8 as affected, while the vendor’s advisory and its 8.13 change log both identify 8.13.7 as containing the fix. For remediation guidance, this article follows the vendor’s own advisory and release record.

The Change Logs Got There Before the Blog

Both advisories carry a line that reads as if the fix were still pending: the issue “is currently being addressed”, and administrators should update “after the patched release is available”. The change logs already list the builds. The 9.0 change log, modified on September 3, lists version 9.0.8, with entry WHMCS-27923, “Security Fix for CVE-2026-67399”, and WHMCS-27908, “Security Fix for CVE-2026-67398”, alongside three fixes to the Plesk server module. The 8.13 change log, modified the same day, lists 8.13.7 with the same two security entries and nothing else. As of September 4 the WHMCS blog had no post for either build; its most recent release post is for 9.0.7 and 8.13.6 on August 25, which the company said “addresses several security items alongside routine platform fixes”.

It is also the fifth 9.0 maintenance release in a row to carry security fixes. Version 9.0.4 in May closed CVE-2026-29204, an insufficient ownership check in the client area scored 9.1 in its CVE record, and 9.0.5, 9.0.6 and 9.0.7 followed with security entries, many of them labeled only “Undisclosed Security Fix”, 16 of those in 9.0.5 alone.

Plesk Patches Three Flaws That Start From an Ordinary Customer Account

No Patch Below 8.13

The operational point for hosting companies is in the version list. The 2CheckOut advisory states that a fix “is only available for supported WHMCS versions” and that anyone on 4.5 or later “must upgrade to WHMCS 9.0.8 or WHMCS 8.13.7”. The RCE advisory gives the same two builds. An installation on WHMCS 8.0 through 8.12 has no patch available within its current release line and must upgrade to 8.13.7 or 9.0.8. For that group, the 2CheckOut workaround buys time on the smaller flaw and nothing on the larger one. The burden falls on self-hosted installations: WHMCS Cloud, according to the company’s documentation, “updates WHMCS for you automatically”.

About the Data

Advisories, change logs and the blog were read on September 4, 2026. The CVE record for CVE-2026-67399 had not been published at that time; the scores and classifications quoted for CVE-2026-67398 and CVE-2026-29204 are taken from their CVE records.