EUVD-2026-78136
GHSA-5jq9-2qvc-rc4h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WHMCS network endpoint
-
DeliverySubmit crafted serialized payload
-
ExploitTrigger unsafe deserialization (CWE-502)
-
ExecutionExecute gadget chain as web user
-
ImpactCompromise billing data and credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to a WHMCS instance running an affected build (9.0.0 through <9.0.8, or 8.0.0 through <8.13.7) that reaches a code path deserializing attacker-controlled data (CWE-502). Per the vendor CVSS vector (PR:N/UI:N/AC:L) no authentication or user interaction is required and default configurations appear affected, but the description does not name the specific endpoint or feature, so the precise pre-auth trigger is not independently confirmed. Primary limiting factors: the target must be an unpatched WHMCS install, and a usable PHP deserialization gadget chain must exist in the deployed code/extension set to convert object injection into full code execution. |
| Impact | This is a genuine high priority, not an inflated-CVSS artifact. The signals align coherently: the vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) describes unauthenticated, network-reachable, low-complexity remote code execution against full confidentiality/integrity/availability, and CISA SSVC corroborates the severity end with Technical Impact 'total' and Automatable 'yes'. CWE-502 (deserialization of untrusted data) plausibly supports the PR:N/AC:L claim if the vulnerable unserialize sink is reachable pre-authentication. Countervailing signals lower the immediacy: SSVC Exploitation is 'none', there is no CISA KEV listing, and no public POC has surfaced, so this is not confirmed active exploitation. EPSS is only 0.69% (51st percentile) - modest, consistent with a freshly disclosed flaw that has a vendor patch but no weaponized exploit yet. The main uncertainty is whether the deserialization sink is truly reachable without authentication; the description says only 'remote attackers' and does not name an endpoint, so PR:N rests on the vendor vector rather than corroborated technical detail. Given RCE + Automatable:yes + a widely-targeted hosting-billing platform, patching should be treated as urgent despite the currently low EPSS. |
| Exploit ScenarioDerived | An attacker sends a crafted request carrying a malicious serialized PHP object to a WHMCS 9.0.x (<9.0.8) or 8.x (<8.13.7) instance; when the application deserializes the attacker-controlled data, a gadget chain triggers arbitrary code execution on the billing server, exposing customer PII, payment/API credentials, and hosting-panel integrations. No authentication is indicated by the CVSS vector (PR:N) and complexity is low (AC:L). No public exploit code has been identified at time of analysis, though SSVC marks the flaw Automatable:yes, so reliable exploitation is expected once details are reverse-engineered from the patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Remote code execution in WebPros WHMCS allows unauthenticated network attackers to run arbitrary code on affected installations by feeding crafted serialized data into a code path that deserializes untrusted input (CWE-502). All WHMCS builds from 9.0.0 up to (but not including) 9.0.8, and from 8.0.0 up to (but not including) 8.13.7, are affected; the vendor vector (PR:N/UI:N/AC:L) indicates no authentication or user interaction is required and that default configurations may be exposed, although the specific vulnerable endpoint or feature is not named in the advisory. No public exploit identified at time of analysis - CISA's SSVC assessment records Exploitation: none and EPSS is 0.69% (51st percentile), but the SSVC Technical Impact is rated total and Automatable is yes, so patching should be treated as high priority.
RemediationAI
Vendor-released patch: upgrade to WHMCS 9.0.8 (for the 9.x line) or 8.13.7 (for the 8.x line) as documented in the vendor advisory at https://help.whmcs.com/m/125386/l/2118034-cve-2026-67399-whmcs-security-update-2026-09-03; the fix is available and there is no indication of a required configuration change. Until maintenance can be completed, apply layered compensating controls, each with trade-offs: (1) restrict network reachability of the WHMCS installation to expected clients and administrative IP ranges, and block the API/admin paths from untrusted networks via firewall or reverse-proxy ACLs - this reduces exposure but will break public ordering, client-area access or third-party integrations if scoped too tightly; (2) deploy WAF/virtual-patching rules that inspect request bodies and parameters for PHP serialized-object payloads (O:…/a:… patterns) on all endpoints - effective against generic payloads but bypassable via encoding tricks and it may generate false positives for legitimate serialized form or API data; (3) reduce the attack surface for gadget chains by disabling unused modules, addons, hooks and third-party composer dependencies so fewer magic-method classes are autoloadable - this lowers the chance of converting object injection into code execution but not the underlying deserialization flaw, and removal must be validated against existing integrations; (4) harden the PHP runtime (restrict disable_functions, run the web user with minimal filesystem write privileges, enforce open_basedir) to blunt post-exploitation code execution - this is defence-in-depth and does not prevent the initial object injection. After upgrading, review logs for anomalous POST requests containing serialized data and treat any suspected hit as full host compromise, since the issue permits arbitrary code execution under the web server account.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WHMCS is a PHP-based billing, client-management and automation platform used by hosting providers, resellers and MSPs to handle orders, invoicing, support tickets, domains and provisioning; it is exposed as a web application, frequently with third-party modules, payment gateways and hooks installed. The root cause class is CWE-502, Deserialization of Untrusted Data: the application passes attacker-controllable input into PHP's unserialize() (or an equivalent object-reconstruction path) without sufficient validation, so an attacker can inject a PHP object with attacker-chosen properties. Impact escalates from object injection to full code execution only if a usable gadget chain (magic methods such as __destruct/__wakeup chaining into file write or call_user_func-style sinks) exists in the deployed core code or in the installed extension/composer dependency set - which is the main uncertainty in the practical exploitability of this CVE. CPE data confirms the affected codebase as cpe:2.3:a:webpros:whmcs with no version constraint, matching the vendor's version ranges. The vendor advisory maps the issue to the WHMCS 2026-09-03 security update.
Know when Whmcs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vendor describes unauthenticated remote deserialization-to-RCE with low complexity, yielding full C/I/A impact; scope unchanged as code runs within the WHMCS process context.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.
Executive ViewAI
WHMCS, a widely used billing and automation platform for web hosting and domain resellers, is affected by a critical unauthenticated remote code execution vulnerability. This flaw allows attackers to execute arbitrary code on vulnerable servers, potentially leading to full system compromise, theft of customer and payment data, and service outages. Although no public exploit identified at time of analysis, the severity and ease of automation warrant immediate leadership attention to protect customer trust and avoid regulatory repercussions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all vers
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and ea
Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4. Rated medium se
submitticket.php in WHMCompleteSolution (WHMCS) 5.03 allows remote attackers to inject arbitrary code into a subject fie
Exploit-DB