CVE-2026-16272

CVSS 9.1 (critical) · published 2026-09-09

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.

Weakness: CWE-348

Source: NVD CVE-2026-16272

References

• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1034

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.