CVE-2026-67399

Name of the Vulnerable Software and Affected Versions WHMCS versions 9.0.0 through 9.0.7 WHMCS versions 8.0.0 through 8.13.6

Description An unauthenticated flaw involving the deserialization of untrusted data allows remote attackers to send forged payloads to execute arbitrary code, potentially leading to a full compromise of the installation. Deserialization is the process of converting a data format, such as JSON or XML, back into an object that a programming language can use.

Recommendations Update WHMCS versions 9.0.0 through 9.0.7 to version 9.0.8. Update WHMCS versions 8.0.0 through 8.13.6 to version 8.13.7.