WHMCS CVE Patch (CVE-2026-29204)

SilverCreek · May 12

Providers, prepare to patch this newest one in WHMCS this time.

CVE: CVE-2026-29204

Email:

Hello <snip>,

Tomorrow, May 13, 2026, we will be releasing an important maintenance update for the WHMCS 9.0 and 8.13 series. This release addresses a security vulnerability (CVE-2026-29204) which has been identified in WHMCS 7.4 and later. 

Recommended versions with required updates are WHMCS 9.0.4 and WHMCS 8.13.3 - and will be available at 19:00 PM GMT, Wednesday, May 13, 2026.

emgh · May 12

PSA: shit software is still shit software please update shit software to newest version of shit software

Neoon · May 12

10.0 dang, not even my waifu scores that high.

sillycat · May 12

@Dasabo important

FatGrizzly · May 12

WHMCS SECURITY 2.0 incoming??

reminds me of 2023 when all whmcs instances running broken themes were getting breached

Dasabo · May 12

@sillycat said:
@Dasabo important

Thank you for the quote, we are doing the update asap.

xvps · May 12

@Dasabo said:

@sillycat said:
@Dasabo important

Thank you for the quote, we are doing the update asap.

First of all, you can't do the update ASAP.

You would know if you had read the email WHMCS has sent out to their customers.

It is a notification, so everyone knows it's an important security update, and can update the second the version update is released.

JabJab · May 12

@xvps said:

@Dasabo said:

@sillycat said:
@Dasabo important

Thank you for the quote, we are doing the update asap.

First of all, you can't do the update ASAP.

You would know if you had read the email WHMCS has sent out to their customers.

It is a notification, so everyone knows it's an important security update, and can update the second the version update is released.

Hey, do you know what P stands for in ASAP?

:-D

xvps · May 12

@JabJab said:

@xvps said:

@Dasabo said:

@sillycat said:
@Dasabo important

Thank you for the quote, we are doing the update asap.

First of all, you can't do the update ASAP.

You would know if you had read the email WHMCS has sent out to their customers.

It is a notification, so everyone knows it's an important security update, and can update the second the version update is released.

Hey, do you know what P stands for in ASAP?

:-D

Please go away. I misread it as now.

Dasabo · May 12

@xvps said:

@Dasabo said:

@sillycat said:
@Dasabo important

Thank you for the quote, we are doing the update asap.

First of all, you can't do the update ASAP.

You would know if you had read the email WHMCS has sent out to their customers.

It is a notification, so everyone knows it's an important security update, and can update the second the version update is released.

ASAP mean when the update is released ofc... the release will happen tomorrow 13 may as per the WHMCS email we got 1 hour ago..

xvps · May 12

@Dasabo said:

@xvps said:

@Dasabo said:

@sillycat said:
@Dasabo important

Thank you for the quote, we are doing the update asap.

First of all, you can't do the update ASAP.

You would know if you had read the email WHMCS has sent out to their customers.

It is a notification, so everyone knows it's an important security update, and can update the second the version update is released.

ASAP mean when the update is released ofc... the release will happen tomorrow 13 may as per the WHMCS email we got 1 hour ago..

Yeah, I know.

I am tired and misread you reply.

I think i will call it a day before I make more fuckups.

Dasabo · May 12

@xvps said:

@Dasabo said:

@xvps said:

@Dasabo said:

@sillycat said:
@Dasabo important

Thank you for the quote, we are doing the update asap.

First of all, you can't do the update ASAP.

You would know if you had read the email WHMCS has sent out to their customers.

It is a notification, so everyone knows it's an important security update, and can update the second the version update is released.

ASAP mean when the update is released ofc... the release will happen tomorrow 13 may as per the WHMCS email we got 1 hour ago..

Yeah, I know.

I am tired and misread you reply.

I think i will call it a day before I make more fuckups.

LOL

rdes · May 12

It's already public:
https://sec.kaitan.id/cves/CVE-2026-29204

Francisco · May 12

Here's the 8.13 fix from their forums.

https://cdn.discordapp.com/attachments/261222573508001793/1503839614085890168/whmcs_v8.13.0-supporthotfix.2_aaed4fe.220_WHMCS-22228_homepage-layout.zip?ex=6a04cf47&is=6a037dc7&hm=78fd23df0692249c4ccfc880b7811b83f11db1d950fb889e866497fc691c1428&;

Francisco

MikeA · May 12

The good thing, it seems like this can be blocked with a WAF rule, or even a WHMCS hook, from what I gather.

rdes · May 12

@MikeA Mind a share mod_security rule or hook? I don't have access to discord.

FatGrizzly · May 12

@MikeA said:
The good thing, it seems like this can be blocked with a WAF rule, or even a WHMCS hook, from what I gather.

I doubt that you can block with a WAF rule, as its just an IDOR, would be hard to match.

I think it might be possible with a hook, not sure.

good luck to the ones who are running whmcs 7.4 ish

MikeA · May 12

@FatGrizzly said: good luck to the ones who are running whmcs 7.4 ish

WHMCS ownership rubbing their hands together every new exploit to get the few remaining owned license holders to change to subscriptions

@rdes said:
@MikeA Mind a share mod_security rule or hook? I don't have access to discord.

not sure what discord you're referring to, but I don't have a rule. Either way since there is a patch available for 8.13 per francisco above it's definitely better to just swap the single file out.

rdes · May 12

Sorry, I thought maybe they shared some workaround on the whmcs discord. I have a version older than 8.1

FatGrizzly · May 12

@rdes said:
Sorry, I thought maybe they shared some workaround on the whmcs discord. I have a version older than 8.1

Temporarily block all requests containing addonId to clientarea.php

and ofcourse, this will block/break WHMCS end-user functionality.

FatGrizzly · May 12

@MikeA said: WHMCS ownership rubbing their hands together every new exploit to get the few remaining owned license holders to change to subscriptions

This and look at this shit.

If you use WHMCS Cloud, no action is required. We have already updated all WHMCS Cloud-hosted installations.

Wow.

MrRadic · May 12

@Francisco said:
Here's the 8.13 fix from their forums.

https://cdn.discordapp.com/attachments/261222573508001793/1503839614085890168/whmcs_v8.13.0-supporthotfix.2_aaed4fe.220_WHMCS-22228_homepage-layout.zip?ex=6a04cf47&is=6a037dc7&hm=78fd23df0692249c4ccfc880b7811b83f11db1d950fb889e866497fc691c1428&;

Francisco

Date on this is May 13, 2025, you sure?

FatGrizzly · May 12

@MrRadic said:

@Francisco said:
Here's the 8.13 fix from their forums.

https://cdn.discordapp.com/attachments/261222573508001793/1503839614085890168/whmcs_v8.13.0-supporthotfix.2_aaed4fe.220_WHMCS-22228_homepage-layout.zip?ex=6a04cf47&is=6a037dc7&hm=78fd23df0692249c4ccfc880b7811b83f11db1d950fb889e866497fc691c1428&;

Francisco

Date on this is May 13, 2025, you sure?

Whoops. i think he missed the year.

Okay so far I think blocking all requests containing addonId to clientarea.php is the solution until whmcs pushes out the update.

Anyone else with any ideas that could help temporarily monkey patch this?

Francisco · May 12

@MrRadic said:

@Francisco said:
Here's the 8.13 fix from their forums.

https://cdn.discordapp.com/attachments/261222573508001793/1503839614085890168/whmcs_v8.13.0-supporthotfix.2_aaed4fe.220_WHMCS-22228_homepage-layout.zip?ex=6a04cf47&is=6a037dc7&hm=78fd23df0692249c4ccfc880b7811b83f11db1d950fb889e866497fc691c1428&;

Francisco

Date on this is May 13, 2025, you sure?

You're right, I had seen clientarea.php and assumed it was the patch.

I can't seem to find any hotfix download anywhere, so, wonderful.

Francisco

btchost · May 12

Temporary mitigation for WHMCS CVE-2026-29204: this hook remove exposure to addon/service ownership abuse until the official WHMCS patch is released. Remove it after applying the vendor update.

https://hastebin.com/share/mafikogozu.php

VaneHost · May 12

They released the patch officially.

https://download.whmcs.com/

AD_Jay · May 12

@btchost said:
Temporary mitigation for WHMCS CVE-2026-29204: this hook remove exposure to addon/service ownership abuse until the official WHMCS patch is released. Remove it after applying the vendor update.

https://hastebin.com/share/mafikogozu.php

We've gone with this patch for now, but changed the hook from ClientAreaPage to ClientAreaProductDetailsPreModuleTemplate. The latter hook runs before the code we believe is bad, whereas ClientAreaPage runs after and may be too late.

SilverCreek · May 12

@AD_Jay said:

@btchost said:
Temporary mitigation for WHMCS CVE-2026-29204: this hook remove exposure to addon/service ownership abuse until the official WHMCS patch is released. Remove it after applying the vendor update.

https://hastebin.com/share/mafikogozu.php

We've gone with this patch for now, but changed the hook from ClientAreaPage to ClientAreaProductDetailsPreModuleTemplate. The latter hook runs before the code we believe is bad, whereas ClientAreaPage runs after and may be too late.

ClientAreaProductDetailsOutput is the better one to hook onto. The PreModuleTemplate is a bit funky.

AD_Jay · May 12

ClientAreaProductDetailsOutput seems fine too, yes.

This is the version we have with a few changes from the other link, such as only running when modop and addonId present in the request. https://hastebin.com/share/irovuhucey.php

kt · May 12

They appear to have released the patch already.

Chalipa · May 12

What about Version: 7.0.3 ?

No support/updates left

Howdy, Stranger!

Categories

In this Discussion

WHMCS CVE Patch (CVE-2026-29204)

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

WHMCS CVE Patch (CVE-2026-29204)

Comments