CVE Alert: CVE-2026-16037 – PayTR Payment and Electronic Money Institution Inc. – PayTR Virtual Pos iFrame API (v9x) WHMCS Module

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3.

## AI Summary Analysis

**Risk verdict:** This is a high-priority internet-facing weakness with an easily automatable attack path, but there is currently no evidence in the supplied data of active exploitation or inclusion in a known-exploited catalogue.

**Why this matters:** Successful abuse could undermine payment callback authentication and allow attackers to influence how transactions are validated or recorded. The likely business consequences include fraudulent order fulfilment, disputed payments, revenue leakage and loss of confidence in billing operations. The stated technical impact is partial, so compromise of the host or broad data theft is not implied.

**Most likely attack path:** An unauthenticated remote attacker can send repeated requests to the exposed callback endpoint without user interaction; low complexity and network reachability make probing practical at scale. Timing observations may help identify valid authentication behaviour, after which forged or replayed callbacks could affect transaction workflows. Scope is unchanged, so lateral movement is not expected directly, although compromised payment state may provide a route into connected fulfilment or account processes.

**Who is most exposed:** Internet-facing WHMCS installations using the affected payment integration, particularly shared-hosting, reseller and small-business environments with publicly reachable callback URLs and limited monitoring.

Alert on abnormal callback request rates, timing-probe patterns or repeated near-identical requests.

Correlate callbacks with genuine provider-side transaction records.

Flag payment-state changes lacking a matching customer session or order event.

Review web, application and payment logs for unusual source networks and replayed identifiers.

Mitigation and prioritisation:

Upgrade to the vendor-fixed release as an urgent change; **treat as priority 1** if exploitation evidence emerges.

Temporarily restrict callback access by trusted provider networks where feasible.

Enforce signed, nonce-bound, replay-resistant callbacks and server-side transaction reconciliation.

Monitor closely during deployment and review recent payment state changes for fraud.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.