TWO critical vulnerabilities have been identified in WHMCS, the popular billing platform, with a vendor-issued security update now available to address both. The first flaw, CVE-2026-67399, is a remote code execution (RCE) vulnerability that stems from input validation weaknesses in WHMCS. Attackers can submit forged payloads under certain conditions, enabling arbitrary code execution and potentially full control of affected hosting environments and billing data.
The second issue, CVE-2026-67398, resides in the 2CheckOut payment gateway module and allows unauthenticated users to extract personally identifiable information, including clients’ names, addresses, emails and phone numbers. The advisory notes that, while the data leak is a concern, this exposure is mitigated by the unauthorised access being tied to the module in question.
Affected versions span multiple branches: CVE-2026-67399 impacts all WHMCS 8.0.x and newer, while CVE-2026-67398 affects WHMCS 4.5.0 onward. Both flaws are present in all WHMCS 9.x builds prior to 9.0.8 and all 8.x builds prior to 8.13.7. To remediate, WHMCS has released updates WHMCS 9.0.8 and 8.13.7, designed to patch both vulnerabilities.
As a temporary mitigation for the data-disclosure issue, administrators are advised to deactivate the 2CheckOut gateway module in system configuration until the patched release can be applied. The vendor confirms there are no public exploits at the time of the advisory, but deployments should prioritise patching to restore a secure state.