CVE-2026-16272 Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS Module
Attackers can spoof client IP addresses via untrusted HTTP headers in the PayTR WHMCS module, bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16272?
CVE-2026-16272 is a critical vulnerability in PayTR Virtual Pos iFrame API WHMCS Module, published on 9 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Exploitation of Trusted Identifiers.
This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.
Weakness: CWE-348
Which versions are affected by CVE-2026-16272?
How do I fix CVE-2026-16272?
No fix has been published for CVE-2026-16272 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-16272 being exploited?
There is no known exploitation of CVE-2026-16272 in the wild and no public exploit code.
Sources
Also known as GHSA-g622-qgc4-8v95.