WHMCS Patches Unauthenticated Code Execution CVE-2026-67399: Hosting Billing Systems Face Full Takeover
Hosting billing platform WHMCS disclosed two high-severity vulns on September 3: CVE-2026-67399 unauthenticated code execution enabling full system takeover, and CVE-2026-67398 leaking customer names and addresses. Affects multiple 9.x and 8.x versions.
Incident Overview
On September 3, WHMCS—a hosting billing and automation platform widely deployed by VPS and cloud providers—disclosed two security vulnerabilities. CVE-2026-67399 involves forged payloads. Under vendor-undisclosed conditions, an unauthenticated attacker can execute arbitrary code and fully take over a WHMCS install and all of its data. The second vulnerability, CVE-2026-67398, traces back to 4.5.0: when the 2CheckOut payment gateway is enabled, an unauthenticated attacker can obtain customer names, contact details, and postal addresses.
WHMCS is the core billing system for the global hosting industry. Large numbers of IDC and cloud providers rely on it to manage customers, orders, and invoices. Full takeover of the billing system lets attackers steal all customer records and billing data, tamper with service configuration, bulk-export the database, and impersonate the host to phish customers. Attacks against this class of platform have historically triggered industry-wide cascade incidents. Hosting providers and operators of self-hosted WHMCS should treat this as high priority.
Affected Versions and Fixes
- CVE-2026-67399: all 9.x versions prior to 9.0.8, and all 8.x versions prior to 8.13.7. Fixed in 9.0.8 and 8.13.7.
- CVE-2026-67398: installations since 4.5.0 with the 2CheckOut gateway enabled. Official temporary mitigation: disable the 2CheckOut module.
Neither advisory reports in-the-wild exploitation. Technical details shipped with the patches, so attackers can reverse the diffs, locate the defects, and build exploits. Do not delay upgrades because there is "no known exploit."
Remediation
All WHMCS operators should upgrade immediately to 9.0.8 or 8.13.7. Sites that cannot upgrade yet and have the 2CheckOut gateway enabled should disable that module first. If compromise is suspected:
- Retain web and application logs. Hunt for anomalous files, processes, and admin/API activity.
- Review the database for unexpected admin accounts or payment callback records.
- Rotate credentials in the confirmed exposure scope: database passwords, API keys, and backend accounts.
Watch for public exploit details, in-the-wild reports, and vendor revisions to the affected version range.
References
- Border Cyber Group: Threat Intelligence Briefing (WHMCS CVE-2026-67399/67398, citing WHMCS official advisory)