CVE-2026-16037

CVE-2026-16037 is an observable timing discrepancy (CWE-208) in the PayTR Virtual POS iFrame API v9x module for WHMCS, in which operations that should take constant time complete at measurably different speeds. A remote, unauthenticated attacker can send crafted requests and measure response-time differences to perform black-box reverse engineering of the module's secret verification logic. The scored impact is high confidentiality loss (CVSS C:H), potentially allowing reconstruction of the module's secret key material used to secure PayTR payment callbacks. It affects hosting businesses and resellers running WHMCS with the PayTR iFrame API module v9.0.0 through before v9.0.3 to accept PayTR payments. There is no public proof of concept, it is not listed in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so no exploitation is currently known.

What to do: Upgrade the PayTR Virtual POS iFrame API WHMCS module to v9.0.3 or later and verify the installed version in the WHMCS module settings. Sites that cannot update immediately should review payment callback logs for anomalies and consider restricting network access to the WHMCS endpoints. No workaround for the timing channel itself is known, so updating is the primary mitigation.