Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-67398 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://help.whmcs.com/m/125386/l/2116695-cve-2026-67398-whmcs-security-update-2026-09-03	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-862	Missing Authorization	[email protected]

Affected Products

Product	Versions
WHMCS	>= 9, < 9.0.8 >= 8, < 8.13.7 ~4.5
CPE cpe:2.3:a:whmcs:whmcompletesolution:::::::: cpe:2.3:a:whmcs:whmcs:::::::: Remediation Upgrade: 9.0.8moderate effort Upgrade: 8.13.7moderate effort Workaround:low effort Deactivate the 2CheckOut payment gateway module: 1. Go to Configuration > System Settings > Payment Gateways. 2. Click Deactivate for the 2CheckOut payment gateway module. 3. Select an alternative payment gateway. The system will automatically reassign any services, invoices, transactions, and pay methods to this new payment gateway.

Product

Versions

WHMCS

>= 9, < 9.0.8

>= 8, < 8.13.7

~4.5

CPE

cpe:2.3:a:whmcs:whmcompletesolution:*:*:*:*:*:*:*:*
cpe:2.3:a:whmcs:whmcs:*:*:*:*:*:*:*:*

Remediation

Upgrade: 9.0.8moderate effort
Upgrade: 8.13.7moderate effort
Workaround:low effort
Deactivate the 2CheckOut payment gateway module: 1. Go to Configuration > System Settings > Payment Gateways. 2. Click Deactivate for the 2CheckOut payment gateway module. 3. Select an alternative payment gateway. The system will automatically reassign any services, invoices, transactions, and pay methods to this new payment gateway.

Change History

3 change records found show changes

Date	Action	Recorded By
Sep 14, 2026	CVE Modified	[email protected]
Sep 4, 2026	CVE Modified	CISA-ADP
Sep 4, 2026	New CVE Received	[email protected]