CVE-2026-67399

WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 contains a deserialization of untrusted data flaw (CWE-502) that lets a remote attacker achieve arbitrary code execution. The CVSS 4.0 score of 9.3 (critical) with no privileges and no user interaction required indicates it can be triggered unauthenticated, by sending a crafted serialized payload to an affected WHMCS installation which is then deserialized by the application. Successful exploitation gives the attacker code execution on the web server, exposing billing records, customer and payment data, API credentials, and potentially connected hosting-control-panel infrastructure. All operators running WHMCS 9.0.0–9.0.7 or 8.0.0–8.13.6, especially internet-facing billing deployments, are affected. As of now there is no known public proof of concept, no CISA KEV listing, and no confirmed in-the-wild exploitation.

What to do: Upgrade immediately to WHMCS 9.0.8 or 8.13.7 or later; confirm your version in the WHMCS admin area before and after patching. Until patched, restrict access to the WHMCS installation (IP allowlisting/WAF rules on admin and client-facing endpoints) and monitor web server logs for unusual POST requests containing serialized PHP objects. After remediation, rotate WHMCS database credentials, API keys, and any stored server/hosting-panel credentials, and review logs for indicators of prior compromise.