Missing authorization in the WebPros WHMCS 2Checkout payment gateway exposes customer data

Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.

The confirmed affected boundaries are:

• WHMCS 9.x: builds before 9.0.8 are affected; the vendor identifies 9.0.8 as fixed.
• WHMCS 8.x: builds before 8.13.7 are affected; the vendor identifies 8.13.7 as fixed.
• Older EOL builds: the structured affected facts mark WHMCS from 4.5.0 through versions less than 8.12.2 as affected.

The vendor advisory states that a fix is available only for supported WHMCS versions. The structured record and vendor advisory express the older EOL coverage differently, so an EOL build not explicitly listed should not be treated as safe without confirmation from WebPros.

WebPros WHMCS does not adequately verify authorization at an endpoint in the 2Checkout payment gateway module. The endpoint is reachable over the network by an unauthenticated user and, under specific conditions, a request can return WHMCS customer data without the required authorization.

The available evidence does not disclose the precise authorization check, endpoint name, request parameters, or conditions required to retrieve the data. The exact exploit request and minimum configuration therefore remain unknown. The confirmed scope is confidentiality of customer data through the 2Checkout module; no evidence establishes that the flaw permits data modification or service disruption.

• Reachability: The flaw is described as reachable through a network endpoint of the 2Checkout payment gateway.
• Authentication: No authentication is required according to the vulnerability record.
• User interaction: No user interaction is required according to the supplied data.
• Conditions: Data retrieval occurs only under specific conditions, but those conditions are not publicly detailed in the available evidence.
• Status: The record's public_exploit field is false; no specific exploit, campaign, victim, or breach is identified. The available enrichment records exploitation as none and automatable as no, within the scope of that assessment.

The confirmed technical outcome is that an unauthenticated user can read customer data through the 2Checkout module endpoint when the specific conditions are met. The exposed data may include personally identifiable information, making loss of confidentiality the primary consequence and potentially increasing incident-response scope.

The flaw does not require account privileges or user interaction according to the available data. The record does not establish data modification, code execution, privilege escalation, administrative takeover, or loss of WHMCS availability. The amount of data accessible and the exact conditions required remain undisclosed.

The flaw can expose customer personally identifiable information, including names, addresses, cities, states, postal codes, countries, email addresses, and phone numbers.

Unauthorized retrieval may create privacy risk, investigation requirements, and possible notification obligations depending on the data, scope, and applicable rules. Because the access does not require an account, exposure could originate outside the system if the endpoint's specific conditions are met. The available evidence confirms data retrieval only; it does not establish data modification, administrative takeover, or service disruption.

1. Upgrade supported deployments to WHMCS 9.0.8 or WHMCS 8.13.7, depending on the branch in use. These are the fixed releases explicitly identified by the vendor.
2. If an immediate upgrade is not possible, temporarily deactivate the 2Checkout module at Configuration > System Settings > Payment Gateways, then select an alternative payment gateway. This is a temporary mitigation.
3. For EOL deployments, move to a supported WHMCS branch and apply one of the fixed releases above. The available evidence does not confirm a separate fix for EOL versions.
4. After the change, verify the actual installed version, the 2Checkout module status, and the reassignment of services, invoices, transactions, or payment methods according to the WHMCS operating procedure.

1. Inventory all WebPros WHMCS deployments and compare their versions with the affected branches in affected_summary.
2. Check the 2Checkout module at Configuration > System Settings > Payment Gateways to identify installations where the component is enabled.
3. If web or application logs are available, review unauthenticated requests to the 2Checkout gateway endpoint and unusual responses containing customer data. This is a precautionary review; no specific IOC, log signature, or request pattern is provided.
4. Assess what customer data may have been accessed while an affected version was deployed. The absence of related log evidence does not prove that the system was safe.
5. After upgrading, verify the installed WHMCS release and the 2Checkout module state, and confirm that the module is enabled only on a vendor-supported, fixed branch.