## What Happened
WHMCS released maintenance updates (Sept 3, 2026) to address two critical vulnerabilities. The issues include unauthenticated remote code execution and exposure of client PII via the 2CheckOut payment gateway module. The article states there is no confirmed exploitation yet.
## Technical Details
- CVE-2026-67399 (CVSSv4 9.3): A security vulnerability in WHMCS 8.0.x and later involving submission of forged payloads without adequate restrictions. The advisory describes that an unauthenticated attacker can send crafted network requests to execute code on the host.
- CVE-2026-67398 (CVSSv4 8.2): Affects the 2CheckOut payment gateway module. An unauthenticated user could retrieve client PII including name, address, city, state, postal code, country, email, and phone number by querying the payment handler/private customer directories.
- Exploitation status: Not exploited per the article; no public proof-of-concept exploit code exists.
## Affected
- WHMCS 9.x installations prior to 9.0.8
- WHMCS 8.x releases prior to 8.13.7
- 2CheckOut payment gateway module (as part of the affected WHMCS versions)
## Impact
- Unauthenticated remote code execution on the WHMCS host (via CVE-2026-67399).
- Unauthorized access to client PII through the 2CheckOut module (via CVE-2026-67398).
## Mitigation
1. Update WHMCS to 9.0.8 (or 8.13.7 as applicable).
2. If immediate updating is not possible, deactivate the 2CheckOut payment module in WHMCS payment gateway settings.