WHMCS Patches Critical Unauthenticated RCE (CVE-2026-67399) — Update to 9.0.8 or 8.13.7
WHMCS has released a security update addressing a critical vulnerability that may allow an unauthenticated attacker to execute arbitrary code on a server running the billing platform. Tracked as CVE-2026-67399, the vulnerability affects WHMCS installations from version 8.0 onward. WHMCS released fixes in versions 9.0.8 and 8.13.7, announced in a WHMCS security advisory published on 3 September 2026.
Administrators running older versions should upgrade as soon as possible. Notably, installations running WHMCS 8.0 through 8.12 cannot receive the fix within their existing minor-version branch and must upgrade to at least 8.13.7 or move to 9.0.8.
Which WHMCS Versions Are Affected?
| Version | Affected | Fixed in |
|---|---|---|
| WHMCS 9.x | All builds before 9.0.8 | 9.0.8 |
| WHMCS 8.x | All builds before 8.13.7 | 8.13.7 |
A second flaw exposes customer data
The same update fixes CVE-2026-67398, a missing-authorization vulnerability (CWE-862) in WHMCS’s bundled 2CheckOut payment gateway module. WHMCS credits a researcher known as “boomerang” for responsibly disclosing it. The flaw allows an unauthenticated user to retrieve a customer’s personal information, including name, address, city, state, postal code, country, email address, and phone number, and affects installations running WHMCS 4.5.0 or later. It has been assigned a CVSS 4.0 base score of 8.2 and is rated High.
WHMCS’s advisory gives a specific temporary workaround for this flaw: go to Configuration > System Settings > Payment Gateways, click Deactivate on the 2CheckOut module, and select an alternative gateway. The system automatically reassigns existing services, invoices, transactions, and pay methods to the new gateway. This workaround only covers the 2CheckOut data-exposure issue; it does nothing for the RCE flaw, so installations that don’t use 2CheckOut should still upgrade, since both fixes ship in the same releases.
Why the WHMCS Vulnerability Matters
WHMCS is more than a billing application. For many hosting businesses, it sits at the center of customer management, billing and automated service provisioning. Installations can connect to cPanel/WHM, Plesk, DirectAdmin, domain registrars and payment gateways, with API credentials and other sensitive configuration data used to keep those systems connected.
That makes an unauthenticated remote code execution vulnerability particularly serious. A successful compromise of the WHMCS server could potentially expose customer data, billing information, and credentials used by connected services. The extent of the impact will depend on the privileges and integrations configured within each installation.
WHMCS has not disclosed any confirmed exploitation of CVE-2026-67399 in the wild, and no public exploit code had been reported at the time of writing. However, the absence of known exploitation should not be treated as a reason for delaying patching. Once a vulnerability is publicly disclosed and a fix becomes available, attackers can analyze the changes between vulnerable and patched versions to develop working exploits.
The WHMCS disclosure also comes less than a month after the cPanel authentication vulnerability, CVE-2026-41940, reported in August. Together, the incidents highlight the importance of keeping core hosting infrastructure and business-management software patched as soon as security fixes become available.
What WHMCS Administrators Should Do
Administrators should treat the update as a priority and take the following steps:
1. Check Your WHMCS Version
Log in to the WHMCS Admin Area and navigate to:
Utilities → Update WHMCS
Check the installed version and compare it with the latest supported release.
2. Upgrade to a Fixed Version
Upgrade vulnerable installations to:
- WHMCS 9.0.8, or
- WHMCS 8.13.7
If you are running WHMCS 8.0–8.12, you will need to move to a newer release because there is no security fix for those versions within their existing branches.
3. Test Customizations Before Production
If your installation relies on custom modules, hooks, templates or third-party integrations, test the upgrade on a staging environment first.
This is especially important when upgrading across multiple minor versions, as compatibility issues can affect customized WHMCS installations.
4. Disable 2CheckOut if You Cannot Upgrade Immediately
If you use the affected 2CheckOut module and cannot upgrade immediately, deactivate it and switch to an alternative payment gateway. Remember that this only mitigates the customer’s data-exposure vulnerability, not the RCE vulnerability.
5. Review Logs and Credentials
After upgrading, review server and WHMCS access logs for unusual activity. Check administrator accounts for unexpected changes and investigate suspicious authentication or application activity.
If there are indicators of compromise, rotate relevant API keys, passwords, and integration credentials as part of the incident response process.
(Source: WHMCS)
