CVE-2026-16272: Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module
Published Sep 9, 2026
·Updated
Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Exploitation of Trusted Identifiers.
This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3.
Affected Software
1 affected component
PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module<9.0.3
Event History
Sep 9, 2026
CVE Published
via MITRE·08:17 AM
Data Sourced
via MITRE·08:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which module versions are affected?
The issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module versions from v9.0.0 before v9.0.3. Version v9.0.3 is not listed as affected.
2
Can this be exploited remotely without authentication or user interaction?
Yes. The supplied CVSS vector indicates network attack access, low attack complexity, no privileges required, and no user interaction required.
3
What security impact is indicated?
The vulnerability is rated critical with a 9.1 CVSS score. The vector indicates high confidentiality and integrity impact, with no availability impact.