CVE-2026-16272
Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module
CVSS Score
9.1
EPSS Score
0.0%
EPSS Percentile
0th
Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3.
| CWE | CWE-348 |
| Vendor | paytr payment and electronic money institution inc. |
| Product | paytr virtual pos iframe api (v9x) whmcs module |
| Published | Sep 9, 2026 |
| Last Updated | Sep 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for paytr payment and electronic money institution inc. paytr virtual pos iframe api (v9x) whmcs module
Be the first to know when new critical vulnerabilities affecting paytr payment and electronic money institution inc. paytr virtual pos iframe api (v9x) whmcs module are published โ delivered to Slack, Telegram or Discord.
Get Free Alerts โ
Free ยท No credit card ยท 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
PayTR Payment and Electronic Money Institution Inc. / PayTR Virtual Pos iFrame API (v9x) WHMCS Module
v9.0.0 < v9.0.3
References
Credits
Efe KIRBAล