CVE-2026-67398

CVE-2026-67398 is a missing authorization flaw (CWE-862) in the 2Checkout payment gateway module of WHMCS, the web-hosting billing and automation platform. An unauthenticated remote attacker can send requests to the 2Checkout gateway's endpoint and, under specific conditions (not detailed in the available disclosure), retrieve WHMCS customer data. The impact is confidentiality-only — the CVSS 4.0 vector shows high confidential-data disclosure with no integrity or availability impact, no privileges or user interaction required. Affected deployments are WHMCS 8.13.0 through 8.13.7, 9.0.0 through 9.0.7, and all other end-of-life versions from 4.5.0 onward; installations that do not have the 2Checkout gateway module active are not exposed. There is currently no public proof-of-concept, the issue is not in CISA KEV, and EPSS puts near-term exploitation probability at 0.3% (20th percentile), so no confirmed exploitation is known.

What to do: Upgrade to WHMCS 8.13.8, 9.0.8, or a later supported release; sites running EOL versions from 4.5.0 must move to a supported fixed release. Deployments that do not use the 2Checkout gateway are unaffected, but as an interim measure disable the 2Checkout gateway module and review web logs for unauthenticated requests to its endpoint, then assess any accessed customer data for breach-notification obligations.