EUVD-2026-70849
GHSA-x84h-g4q5-82g8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AT:P in vendor CVSS 4.0 maps to AC:H (2Checkout must be configured); impact is confidentiality-only, read-only customer data retrieval.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
4DescriptionCVE.org
Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.8, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.
AnalysisAI
WHMCS's 2Checkout payment gateway endpoint exposes customer data to unauthenticated remote attackers due to a missing authorization check (CWE-862) across versions 8.13.0 through pre-8.13.8, 9.0.0 through pre-9.0.8, and all end-of-life releases from 4.5.0 onward. The flaw enables an unauthenticated network attacker who meets specific deployment conditions - the 2Checkout payment gateway must be configured and active - to retrieve WHMCS customer records through the unprotected endpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The 2Checkout payment gateway must be configured and active in the WHMCS installation - the description explicitly states exploitation occurs 'via 2Checkout payment gateway's endpoint under specific conditions,' making this the controlling prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.2 captures a high-confidentiality, network-accessible, zero-privilege flaw, but the AT:P modifier is critical context: the 2Checkout gateway must be enabled and configured, meaning installations using other payment processors (Stripe, PayPal, etc.) exclusively are unaffected. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade WHMCS to version 8.13.8 (8.13.x branch) or 9.0.8 (9.0.x branch) per the vendor security advisory published 2026-09-03 at https://help.whmcs.com/m/125386/l/2116695-cve-2026-67398-whmcs-security-update-2026-09-03. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all WHMCS deployments and confirm which instances have the 2Checkout payment gateway configured and active. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today