CVE-2026-16025

CVE-2026-16025 is an improper validation of quantity input (CWE-1284) in the PayTR Virtual Pos iFrame API (v9x) payment module for WHMCS, which allows attackers to manipulate input data accepted by the module. An unauthenticated remote attacker can trigger the flaw by sending crafted quantity values through the module's network-facing payment interface, with no user interaction or credentials required. Per the published CVSS vector, the impact is confined to availability: manipulated input can disrupt or take down the affected payment/checkout service, with no confidentiality or integrity impact described. Anyone running WHMCS with the PayTR Virtual Pos iFrame API (v9x) module installed in versions 9.0.0 up to (but not including) 9.0.3 is affected, which mainly means hosting and reseller businesses using the Turkish PayTR payment gateway. No exploitation has been reported, no public proof-of-concept exists, EPSS is low (0.3%), and the issue is not in CISA's KEV catalog.

What to do: Upgrade the PayTR Virtual Pos iFrame API (v9x) WHMCS module to version 9.0.3 or later. Administrators who cannot patch immediately should check the installed module version in their WHMCS module management panel and monitor the WHMCS checkout/payment callback endpoints for availability problems or crash events, since the rated impact is a denial of service.