Critical · 9.3 CVE-2026-67399 EUVD-2026-78136GHSA-5jq9-2qvc-rc4h

Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.

Published Sep 14, 2026 · Updated Sep 15, 2026 · Assigned by hackerone

Description

Vendor	Product	Affected	Fixed
WebPros	WHMCS	9.0.0 – < 9.0.8, 8.0.0 – < 8.13.7	9.0.8