Missing Authorization in 2Checkout Payment Gateway of WHMCS

CVE-2026-67398

What is CVE-2026-67398?

A missing authorization vulnerability has been identified in the 2Checkout payment gateway integrated with WHMCS. This issue affects versions of WHMCS from 8.13.0 prior to 8.13.8, as well as 9.0.0 before 9.0.8 and earlier end-of-life versions starting from 4.5.0. Under specific conditions, an unauthenticated user may exploit this vulnerability to access sensitive WHMCS customer data through the payment gateway's endpoint, thereby posing significant security risks.

References