EUVD-2026-74769
GHSA-g622-qgc4-8v95
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated remote forgery of payment state gives I:H; confidentiality lowered to C:L since disclosure is not the described impact, no availability effect.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Exploitation of Trusted Identifiers.
This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3.
AnalysisAI
Payment-confirmation forgery in PayTR's Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0 to before v9.0.3) lets remote unauthenticated attackers spoof a trusted payment identifier so the module treats an unpaid or attacker-controlled transaction as legitimately settled. Reported by TR-CERT, it stems from the module relying on a less-trusted, client-influenceable source instead of server-to-server verification of PayTR's callback. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a WHMCS installation running the PayTR Virtual Pos iFrame API (v9x) module at v9.0.0-v9.0.2 with the vulnerable payment callback/return-handling flow reachable over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) indicates trivially reachable, unauthenticated network exploitation with high confidentiality and integrity impact and no availability impact - consistent with a financial-fraud/order-state-forgery flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the PayTR Virtual Pos iFrame API (v9x) WHMCS Module to v9.0.3 or later, which is the first fixed release per the affected-range data (from v9.0.0 before v9.0.3). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit transaction logs for anomalies and identify all systems running PayTR WHMCS Module versions 9.0.0-9.0.2; consider temporarily disabling this payment method if business continuity permits. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Timing side-channel in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0-v9.0.3) enables unauthenticated remot
Input data manipulation in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module versions 9.0.0 through 9.0.2 allows unaut
Same weakness CWE-348 – Use of Less Trusted Source
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today