Paper/Archive/CVE-2026-16272

CVE-2026-16272

PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module — Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

EPSS 0.2%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 11.4.114 × 202.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.

Affected

ProductAffectedFixed inSource

PayTR Virtual Pos iFrame API WHMCS Modulev9.0.0 – < v9.0.3v9.0.3CNA

Scores by source

TR-CERT (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1034