CVE-2026-16272CWE-348

CVE-2026-16272

Critical · published September 9, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
3.4
In the wild
Unconfirmed
What it is

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Exploitation of Trusted Identifiers.

This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00144 · 3.4th percentile
Weakness
CWE-348 · Use of Less Trusted Source
Published
2026-09-09T13:17Z
References (1)
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1034 · [email protected]
EPSS history
Timeline
  • 10 SEP 03:16Z
    EPSS moved — → 0%
    epss
  • 09 SEP 08:17Z
    Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module
    cvelistv5