CVE-2026-16272: Critical Client IP Spoofing in PayTR WHMCS Payment Module

Critical Trusted-Source Flaw in PayTR's WHMCS Payment Module

TR-CERT disclosed CVE-2026-16272, a critical vulnerability in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module — a payment gateway integration that lets WHMCS-based hosting and billing platforms accept card payments (including installment options) through PayTR's PCI-DSS Level 1 infrastructure. The flaw allows a remote, unauthenticated attacker to spoof the client IP address the module relies on for trust decisions.

Vulnerability Details

The module derives the client's IP address from an HTTP header that can be freely set by the requester rather than validating it against the actual TCP connection source. Because payment callback and fraud-check logic trusts that header value, a remote attacker can forge it to bypass IP-based trust checks and impersonate PayTR's own servers or a previously-trusted client — with no authentication and no user interaction required.

Affected Products

• PayTR Virtual Pos iFrame API (v9x) WHMCS Module — all versions v9.0.0 up to but not including v9.0.3

This module is used by WHMCS-based hosting providers, resellers, and small businesses to accept PayTR card payments directly inside their billing portal. It is one of three vulnerabilities disclosed against the same module family this cycle, alongside a high-severity input-validation flaw (CVE-2026-16025) and an observable-timing issue (CVE-2026-16037) — all affecting the v9.0.0–v9.0.2 range.

Why This Matters

Payment callback endpoints are a high-value target precisely because they sit at the trust boundary between a merchant's billing system and real money movement. An attacker who can spoof the trusted client IP may be able to submit forged payment-confirmation traffic that the module treats as if it originated from PayTR itself, undermining the integrity of transaction reconciliation on internet-facing WHMCS installations — particularly shared-hosting and reseller environments with publicly reachable callback URLs and limited monitoring.

Remediation

• Upgrade the PayTR Virtual Pos iFrame API (v9x) WHMCS Module to v9.0.3 or later as soon as possible

Interim Mitigations

If an immediate upgrade isn't possible:

1. Restrict callback URL access to PayTR's published server IP ranges at the network/firewall layer rather than relying on the module's internal header-based check
2. Enforce signed, nonce-bound, replay-resistant callbacks with server-side transaction reconciliation against PayTR's API, not just the callback payload
3. Monitor payment logs for callback requests with mismatched or anomalous IP/header combinations
4. Audit recent transactions for confirmations that don't reconcile against PayTR's merchant dashboard

Recommendations for Organizations

• Inventory all WHMCS installations using the PayTR Virtual Pos iFrame API module and confirm the installed version
• Upgrade to v9.0.3+ during the next maintenance window
• Review the two related CVEs (CVE-2026-16025, CVE-2026-16037) affecting the same module range
• Reconcile recent transaction logs against PayTR's merchant dashboard for anomalies

Sources

• NVD — CVE-2026-16272
• OffSeq Threat Radar — CVE-2026-16272
• WHMCS Marketplace — PayTR Virtual Pos iFrame API