Use of Less Trusted Source Vulnerability in PayTR Virtual Pos iFrame API
CVE-2026-16272

9.1CRITICAL

Key Information:

Vendor: Paytr Payment And Electronic Money Institution Inc.
Status: Paytr Virtual Pos Iframe Api (v9x) Whmcs Module
Vendor: CVE Published:; 9 September 2026

🔔 Create Paytr Payment And Electronic Money Institution Inc. Vulnerability Alert

What is CVE-2026-16272?

A security flaw in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module permits exploitation due to reliance on less trusted sources. This vulnerability could allow attackers to manipulate trusted identifiers, potentially compromising payment security. It affects all versions from v9.0.0 to prior to v9.0.3, underlining the importance of immediate updates to secure systems against possible exploitation.

Affected Version(s)

PayTR Virtual Pos iFrame API (v9x) WHMCS Module v9.0.0

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/...

government-resource

CVSS V3.1

Score:

9.1

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 9, 2026
Vulnerability Reserved
Jul 20, 2026

Credit

Efe KIRBAŞ

CVE-2026-16272 Data

JSON