CVE-2026-67398

Deferred Deferred - Pending Action

Missing Authorization in WHMCS via 2Checkout Payment Gateway

Publication date: 2026-09-04

Last updated on: 2026-09-14

Assigner: HackerOne

Description

Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-14

Generated

2026-09-24

AI Q&A

2026-09-04

EPSS Evaluated

2026-09-22

NVD

CVE-2026-67398

EUVD

EUVD-2026-70849

Affected Vendors & Products

Vendor	Product	Version / Range
whmcs	whmcs	to 8.13.8 (exc)
whmcs	whmcs	to 9.0.8 (exc)
whmcs	whmcs	4.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-67398 is a missing authorization vulnerability in WHMCS's 2Checkout payment gateway affecting versions 4.5.0 and later. It allows unauthenticated users to access sensitive customer data like names, addresses, emails, and phone numbers through a specific endpoint under certain conditions.

Detection Guidance

To detect this vulnerability, check if your WHMCS system is running an affected version (8.x before 8.13.7 or 9.x before 9.0.8). Review logs for unauthorized access to the 2Checkout payment gateway endpoint. Ensure the 2Checkout module is not active if you are on an unpatched version.

Impact Analysis

This vulnerability could lead to unauthorized access to customer personally identifiable information (PII) such as names, addresses, emails, and phone numbers. Attackers could exploit it to steal sensitive data without authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to personally identifiable information (PII) such as names, addresses, emails, and phone numbers. Such exposure may violate GDPR requirements for data protection and user consent, as well as HIPAA rules for safeguarding protected health information if applicable.

Mitigation Strategies

Upgrade WHMCS to version 9.0.8 or 8.13.7 or later. As a temporary workaround, disable the 2CheckOut payment gateway module via the WHMCS admin panel under System Settings > Payment Gateways.

Hi! I’m here to help you understand CVE-2026-67398. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70