Observable Timing Discrepancy in PayTR Virtual Pos iFrame API by PayTR Payment and Electronic Money Institution Inc.
CVE-2026-16037

7.5HIGH

Key Information:

Vendor: Paytr Payment And Electronic Money Institution Inc.
Status: Paytr Virtual Pos Iframe Api (v9x) Whmcs Module
Vendor: CVE Published:; 8 September 2026

🔔 Create Paytr Payment And Electronic Money Institution Inc. Vulnerability Alert

What is CVE-2026-16037?

The PayTR Virtual Pos iFrame API presents a security concern due to an observable timing discrepancy vulnerability in its WHMCS Module, affecting versions up to v9.0.3. This flaw enables potential attackers to exploit timing variations for black box reverse engineering, jeopardizing the integrity of payment processing and implying risks for user data confidentiality.

Affected Version(s)

PayTR Virtual Pos iFrame API (v9x) WHMCS Module v9.0.0

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/...

government-resource

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 8, 2026
Vulnerability Reserved
Jul 17, 2026

Credit

Efe KIRBAŞ

CVE-2026-16037 Data

JSON