Denial of Service Vulnerability in Lagom WHMCS Template from Vendor
CVE-2026-6601

5.3MEDIUM

Key Information:

Vendor

Lagom

Status
Whmcs Template
Vendor
CVE Published:
20 April 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-6601?

A resource consumption vulnerability has been discovered in the Lagom WHMCS Template, affecting versions up to 2.4.2. This vulnerability is associated with a particular function within the Datatables component, enabling potential remote exploitation. The lack of response from the vendor following the disclosure highlights the urgency for users to secure their installations against unauthorized access and service disruption.

Affected Version(s)

WHMCS Template 2.4.0

WHMCS Template 2.4.1

WHMCS Template 2.4.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-6601 - Proof of Concept

References

https://vuldb.com/vuln/358236
vdb-entry
https://vuldb.com/vuln/358236/cti
signaturepermissions-required
https://vuldb.com/submit/791943
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

s4nnty (VulDB User)
VulDB CNA Team
.