Deserialization in Webpros Whmcs

CVE-2026-67399

Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.

Vulnerability class: Insecure Deserialization

Affected products

Weakness classification (CWE)

References