Quick answers
- Is CVE-2026-29204 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-29204 being exploited in the wild.
- How severe is CVE-2026-29204?
- Critical severity, with a CVSS score of 9.1, published 12 May 2026.
- Which products and versions are affected?
- WHMCS 7.4.0 through 8.13.2, 9.0.0 through 9.0.3.
- Is there a fix for CVE-2026-29204?
- A patch was published on 2026-05-12: Fixed in WHMCS 9.0.4 and 8.13.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-29204 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-29204?
- Check whether you run WHMCS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in `clientarea.php` due to insufficient ownership validation of the `addonId` parameter. While the attacker must be authenticated as a valid client, the application fails to verify if the requested `addonId` belongs to the active session user. This allows an attacker to submit requests on behalf of other users, potentially gaining unauthorized access to victim resources, including linked cPanel accounts. The vulnerability affects WHMCS versions 7.4.0 through 9.0.3 and has been patched in versions 8.13.3 and 9.0.4.
Affected products
- WHMCS WHMCS 7.4.0 through 8.13.2, 9.0.0 through 9.0.3
Timeline
- 2026-05-12: disclosed: Responsibly disclosed via security program
- 2026-05-12: advisory
- 2026-05-12: patched: Fixed in WHMCS 9.0.4 and 8.13.3