CVE-2026-16272: PayTR WHMCS Module Information Disclosure

CVE-2026-16272 Overview

CVE-2026-16272 is a trusted identifier exploitation vulnerability in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module developed by PayTR Payment and Electronic Money Institution Inc. The flaw is classified under [CWE-348] (Use of Less Trusted Source) and affects module versions from v9.0.0 before v9.0.3. Attackers can abuse identifiers accepted from untrusted sources to manipulate payment transaction integrity within WHMCS billing environments. The vulnerability requires no authentication and no user interaction, and it is exploitable over the network.

Critical Impact
Attackers can exploit trusted identifiers to compromise the confidentiality and integrity of payment transactions processed through the PayTR WHMCS module, potentially enabling payment manipulation or unauthorized order fulfillment.

Affected Products

PayTR Virtual Pos iFrame API (v9x) WHMCS Module v9.0.0
PayTR Virtual Pos iFrame API (v9x) WHMCS Module versions up to but not including v9.0.3
WHMCS billing platform deployments integrating the affected PayTR module

Discovery Timeline

2026-09-09 - CVE-2026-16272 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-16272

Vulnerability Analysis

The PayTR Virtual Pos iFrame API WHMCS Module processes payment callback data that originates from a source the module treats as trusted without adequate validation. Under [CWE-348], the software accepts input from a location that an attacker can influence, then uses that input as authoritative for security decisions. In payment integrations, this pattern typically appears when callback handlers accept transaction identifiers, order references, or status parameters without cryptographic verification of origin.

An attacker on the network can forge or replay these identifiers to influence billing outcomes. The module's failure to validate the true source of payment notification data allows manipulation of the trust boundary between the merchant WHMCS instance and the PayTR payment gateway.

Root Cause

The root cause is improper source validation. The module trusts identifiers submitted through payment callback or notification endpoints without verifying that the request genuinely originated from PayTR infrastructure. This validation gap allows external actors to impersonate legitimate gateway responses.

Attack Vector

Exploitation occurs over the network without authentication. An attacker crafts HTTP requests to the module's callback endpoint containing forged trusted identifiers referencing legitimate order records. Because the module treats these identifiers as authoritative, the WHMCS system may process the forged notifications as valid payment confirmations. See the Siber Güvenlik Notification TR-26-1034 for additional technical context.

// No verified proof-of-concept code is publicly available.
// Refer to the vendor advisory for technical details.

Detection Methods for CVE-2026-16272

Indicators of Compromise

Unexpected order status transitions to "Paid" in WHMCS without corresponding funds settlement in PayTR merchant reports
HTTP POST requests to the PayTR callback endpoint originating from IP addresses outside PayTR's published gateway ranges
Duplicate or replayed transaction identifiers appearing in WHMCS transaction logs
Discrepancies between WHMCS invoice records and PayTR merchant panel transaction history

Detection Strategies

Reconcile WHMCS invoice payment records against PayTR merchant panel exports on a scheduled basis
Monitor web server access logs for requests to the PayTR callback URL and validate source IP addresses against gateway allowlists
Alert on repeated callback requests referencing the same transaction identifier within short time windows

Monitoring Recommendations

Enable verbose logging on the WHMCS payment gateway module and forward events to a centralized SIEM for correlation
Establish baseline metrics for legitimate callback volume and alert on statistical anomalies
Track failed integrity checks and unusual parameter combinations in payment notification traffic

How to Mitigate CVE-2026-16272

Immediate Actions Required

Upgrade the PayTR Virtual Pos iFrame API WHMCS Module to v9.0.3 or later immediately
Audit recent WHMCS transaction history for unauthorized paid-status changes since the module was deployed
Restrict inbound access to the payment callback endpoint using web server or WAF allowlists containing only PayTR gateway IP ranges

Patch Information

PayTR addressed this vulnerability in version v9.0.3 of the Virtual Pos iFrame API WHMCS Module. Administrators running any release from v9.0.0 up to but not including v9.0.3 must upgrade to the patched version. Consult the Siber Güvenlik Notification TR-26-1034 for vendor guidance.

Workarounds

Restrict access to the module's callback endpoint at the web server or WAF layer to PayTR's published source IP ranges until patching is complete
Temporarily disable the affected payment gateway module in WHMCS if immediate patching cannot be performed
Implement manual reconciliation of orders against the PayTR merchant panel before fulfillment during the mitigation window

bash

# Example nginx allowlist restricting callback endpoint access
location /modules/gateways/callback/paytr_iframe.php {
    allow  <PAYTR_GATEWAY_IP_RANGE>;
    deny   all;
    include fastcgi_params;
    fastcgi_pass php-upstream;
}