CVE-2026-16272— Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module
Quick assessment
Affected
PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
漏洞描述翻译： PayTR 支付与电子货币机构（PayTR Payment and Electronic Money Institution Inc.）的 PayTR 虚拟 POS iFrame API（v9x）WHMCS 模块存在“使用低可信度信息源”的漏洞，该漏洞可导致可信标识符被利用。 此问题影响 PayTR 虚拟 POS iFrame API（v9x）WHMCS 模块：从 v9.0.0 起，直至 v9.0.3 之前的版本。
Possible ATT&CK Techniques 1 AI
T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16272
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module
Source: CVE Program / CVE List V5
Vulnerability Description
Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Exploitation of Trusted Identifiers.
This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用不可信的源
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PayTR Payment and Electronic Money Institution Inc. | PayTR Virtual Pos iFrame API (v9x) WHMCS Module | v9.0.0 ~ v9.0.3 | - |
|
II. Public POCs for CVE-2026-16272
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16272
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-16272 (1)
-
🔗 T.C. Siber Güvenlik Başkanlığı - Güvenlik Bildirimleri Detay government-resource
IV. Related Vulnerabilities
Same weakness: CWE-348
-
CVE-2026-16732
fastify vulnerable to X-Forwarded-* spoofing under trustProx -
CVE-2026-25552
Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header -
CVE-2026-63220
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRe -
CVE-2026-50243
'response-ip'/'rpz' can rewrite BOGUS answers instead of ret -
CVE-2026-63770
Glance 0.8.5 IP Spoofing Authentication Brute-Force Protecti
V. Comments for CVE-2026-16272
No comments yet