WHMCS 8.13.3 Security Update

8.13 Change Log

WHMCS is working to improve the quality and availability of our supported languages. As a result, this and future WHMCS releases will include more updates and additions to localization files in the /lang and /admin/lang directories.

• These changes will not appear in the list of changelog entries.
• If you customize these files, we recommend reviewing the language string changes in each new WHMCS release before you update.

Version 8.13.7 (Maintenance) #

Maintenance #

• WHMCS-27923 — Security Fix for CVE-2026-67399

Modules #

• WHMCS-27908 — Security Fix for CVE-2026-67398

Version 8.13.6 (Maintenance) #

Implemented #

• WHMCS-26198 — IP allow list for cron task invocation via HTTP request

Maintenance #

• WHMCS-25637 — Improved security around email previews
• WHMCS-26193 — Undisclosed Security Fix
• WHMCS-26284 — Add System Health Check notice if deprecated modules are found
• WHMCS-26382 — Undisclosed Security Fix
• WHMCS-26464 — Block direct access to email campaign and hidden Knowledgebase image attachments
• WHMCS-26502 — Undisclosed Security Fix
• WHMCS-27325 — Improve handling of invalid data during null-IV migration

Modules #

• WHMCS-26360 — Undisclosed Security Fix
• WHMCS-26381 — Improved security for paying invoices with PayPal Payments
• WHMCS-26480 — Remove Hipchat Notification Module
• WHMCS-27149 — Undisclosed Security Fix
• WHMCS-27204 — Improved payment capture logic in Admin Area for Stripe Dynamic Payment Gateway

Version 8.13.5 (Maintenance) #

Maintenance #

• WHMCS-26068 — Undisclosed Security Fix
• WHMCS-26192 — Improved security around Admin password resets.
• WHMCS-26194 — Improved security around User password resets.
• WHMCS-26206 — Improved security around Invoice processing Hook Points
• WHMCS-26338 — Improved security around User logouts.
• WHMCS-26339 — Admins require “View Clients Summary” permission to download client files
• WHMCS-26425 — Undisclosed Security Fix
• WHMCS-26466 — Persist Sign-In Integration notice when appropriate
• WHMCS-26624 — Undisclosed Security Fix

Modules #

• WHMCS-24791 — Improved security for paying invoices with Stripe
• WHMCS-26067 — Improved security for paying invoices with PayPal Basic
• WHMCS-26381 — Improved security for paying invoices with PayPal Payments
• WHMCS-26444 — Improved security of logging in WorldPay FuturePay
• WHMCS-26566 — Corrected variable name for Enom

Version 8.13.4 (Maintenance) #

Maintenance #

• WHMCS-25235 — Undisclosed Security Fix
• WHMCS-25253 — Undisclosed Security Fix
• WHMCS-25271 — Add validation Improvements in Admin Area
• WHMCS-25272 — Undisclosed Security Fix
• WHMCS-26073 — Improved encryption method for sensitive data storage
• WHMCS-26075 — Increased randomness of guest ticket access key generation
• WHMCS-26189 — Undisclosed Security Fix

Modules #

• WHMCS-26056 — Undisclosed Security Fix
• WHMCS-26058 — Undisclosed Security Fix
• WHMCS-26060 — Undisclosed Security Fix
• WHMCS-26061 — Undisclosed Security Fix
• WHMCS-26063 — Undisclosed Security Fix
• WHMCS-26066 — Undisclosed Security Fix
• WHMCS-26072 — Undisclosed Security Fix
• WHMCS-26074 — Undisclosed Security Fix
• WHMCS-26079 — Undisclosed Security Fix
• WHMCS-26145 — Remove Asiapay, Gate2shop, Inpay & Paypoint from distribution
• WHMCS-26261 — Improve security around Reports

Version 8.13.3 (Maintenance) #

Maintenance #

• WHMCS-26041 – Security Fix for CVE-2026-29204

Version 8.13.2 (Maintenance) #

Maintenance #

We are limiting technical details on these changes to protect users who may not yet have upgraded.

• WHMCS-25506 — Undisclosed Security Fix
• WHMCS-25507 — Undisclosed Security Fix
• WHMCS-22710 — Undisclosed Security Fix
• WHMCS-25508 — Improved input field Validation in Admin Area

Version 8.13.1 (Maintenance) #

Maintenance #

We are limiting technical details on these changes to protect users who may not yet have upgraded.

• WHMCS-18936 — Prevent error when sending email from custom email template with bad attachment reference
• WHMCS-19766 — Disabling auto renewal for a domain in the admin area does not cancel the renewal invoice
• WHMCS-22025 — Clarify Ioncube Loader Minimum version for PHP 8.3
• WHMCS-22090 — Improve Activity Log entry for Admin-initiated User password change
• WHMCS-22228 — Layout changes on Client Area homepage after switching the theme (Also known as: WHMCS-22280)
• WHMCS-22233 — Improve formatting for invoice modification log entries
• WHMCS-22245 — Improve CSS for MarketConnect DigiCert landing page
• WHMCS-22289 — Honour parent theme definition for captcha.tpl on Login as Owner link
• WHMCS-22304 — Correct regression for target opening of custom module actions (styled as links) in clientarea sidebar
• WHMCS-22308 — Ensure ticket scheduled actions can be updated or cancelled when language is not set to English
• WHMCS-22450 — Improve visual responsiveness for SocialBee MarketConnect landing page
• WHMCS-22456 — Correct alignment of Admin Global Warning text
• WHMCS-22457 — Correct regression for displaying embedded videos in Knowledgebase articles
• WHMCS-19435 — Undisclosed Security Fix
• WHMCS-19947 — Undisclosed Security Fix
• WHMCS-19950 — Undisclosed Security Fix
• WHMCS-19952 — Undisclosed Security Fix
• WHMCS-19953 — Undisclosed Security Fix
• WHMCS-19954 — Undisclosed Security Fix
• WHMCS-19955 — Undisclosed Security Fix
• WHMCS-19957 — Undisclosed Security Fix
• WHMCS-19958 — Undisclosed Security Fix
• WHMCS-19959 — Undisclosed Security Fix
• WHMCS-19960 — Undisclosed Security Fix
• WHMCS-19967 — Undisclosed Security Fix
• WHMCS-19981 — Undisclosed Security Fix
• WHMCS-19983 — Undisclosed Security Fix
• WHMCS-19984 — Undisclosed Security Fix
• WHMCS-19987 — Undisclosed Security Fix
• WHMCS-19992 — Undisclosed Security Fix
• WHMCS-20029 — Undisclosed Security Fix
• WHMCS-20064 — Undisclosed Security Fix
• WHMCS-20066 — Undisclosed Security Fix
• WHMCS-21726 — Undisclosed Security Fix
• WHMCS-21729 — Undisclosed Security Fix
• WHMCS-21763 — Undisclosed Security Fix
• WHMCS-21765 — Undisclosed Security Fix
• WHMCS-21766 — Undisclosed Security Fix
• WHMCS-21768 — Undisclosed Security Fix
• WHMCS-21769 — Undisclosed Security Fix
• WHMCS-21862 — Undisclosed Security Fix
• WHMCS-21884 — Undisclosed Security Fix
• WHMCS-21998 — Undisclosed Security Fix
• WHMCS-22041 — Undisclosed Security Fix

Modules #

• WHMCS-21375 — Ensure only partial payment amount is capture when appropriate for invoices paid by PayPal Payments (Also known as: MODULE-8180)

Version 8.13.0 (General Availability) #

Maintenance #

• WHMCS-19282 — Stripe Payment Gateway can now be configured in the Getting Started Wizard
• WHMCS-19673 — Correct displayed amount for Total Out on client’s transactions tab following refund of mass pay invoice
• WHMCS-19870 — Allow blank address field for AddClient API
• WHMCS-21701 — Correct UK VAT Number Validation
• WHMCS-21788 — Prevent error during request for SSL certificate status when using right to left language
• WHMCS-21899 — Visual refinements for DigiCert MarketConnect landing page
• WHMCS-21988 — The Getting Started Wizard will now show when you already have a server connected.
• WHMCS-22094 — Correct mobile responsive rendering of footer in blend-new theme
• WHMCS-22137 — Correct API createclientinvite developer documentation
• WHMCS-21533 — Prevent use of unsupported currencies with PayPal Payments

Modules #

• WHMCS-21513 — Ensure PayPal Checkout module works with custom service addons (Also known as: MODULE-7585)

Version 8.13.0 (Release Candidate) #

Maintenance #

• WHMCS-19169 — Correct bulk removal of IPs on Security tab of General Settings
• WHMCS-19286 — Prevent error with Sitejet addon when only annual pricing is configured
• WHMCS-19887 — Correct credit attributes when refunding invoice from View screen
• WHMCS-21790 — Prevent error on Payment Disputes when configuration is invalid for PayPal Payments

Modules #

• WHMCS-21224 — Improve detection of SiteJet Publishing in Plesk (Also known as: WHMCS-21778)
• WHMCS-21272 — Correct identification of currency in callback from Skrill (Also known as: MODULE-8173)
• WHMCS-21786 — Improve handling of Sitejet availability for reseller packages in cPanel

Version 8.13.0 (Beta) #

Implemented #

• WHMCS-18763 — Add support for Troy card type
• WHMCS-19224 — New Getting Started Wizard
• WHMCS-19979 — Introduce SocialBee services via MarketConnect
• WHMCS-20016 — Introduce Add Ticket Reply for Ticket Scheduled Actions
• WHMCS-20055 — Provide admin ability to change user passwords
• WHMCS-20056 — Introduce optimized “Blend-New” Admin theme
• WHMCS-20371 — Implement Add a Ticket Note for Ticket Scheduled Actions
• WHMCS-20440 — Implement Update Custom Field Value to Ticket Scheduled Actions

Maintenance #

• WHMCS-18657 — Prevent error when handling fraud block for free products
• WHMCS-18912 — Ensure daily cron tasks are able to complete when late fees are enabled, but no amounts are configured
• WHMCS-19067 — Correct rendering of response from disable 2FA request
• WHMCS-19094 — Correct padding for “Do Not Store” option on invoice payment screen
• WHMCS-19235 — Remove entry for, now publicly restricted, WHOIS server related to .gr TLDs
• WHMCS-19403 — Prevent error when adding free items to quote
• WHMCS-19456 — Refine CAPTCHA enforcement for checkout form
• WHMCS-19550 — Correct handling of setup intents for micro deposits with Stripe ACH
• WHMCS-19580 — Correct display of checkout’s new account inputs when pre-selected for authenticated user
• WHMCS-19575 — Correct Sitejet SSO link for clients with multiple services
• WHMCS-19711 — Correct date timestamp of Last Capture Attempt on invoices
• WHMCS-19733 — Improve resilience of credit transactions in invoice list
• WHMCS-19829 — Correct padding of buttons on admin ticket reply view
• WHMCS-19845 — Ensure time of transaction is displayed on View screen of invoice
• WHMCS-19864 — Update entry of WHOIS server for .mobi TLD
• WHMCS-19876 — Correct credit reconciliation for refunded invoice with multiple overpayments
• WHMCS-19881 — Correct spacing of mass action buttons on admin ticket list
• WHMCS-19882 — Improve alignment of count indicator on Schedule Actions tab
• WHMCS-19891 — Correct Delete Order operation on “View Orders” screen
• WHMCS-19892 — Assert Manage Invoice permission for changes to payment method of invoice
• WHMCS-19937 — Correct display of buttons in Capture modal on admin invoice page
• WHMCS-19963 — Improve resilience of order processing when prorata is enabled without a prorate date configuration value
• WHMCS-19970 — Ensure usage of custom client VAT field in client area when completing Auto Exemption logic
• WHMCS-19776 — Prevent error on Support Department setup due to translation phrases
• WHMCS-19980 — Remove XOVI Now in MarketConnect
• WHMCS-20006 — Ensure correct relative paths on admin invites page for all URI settings
• WHMCS-20020 — Improve logic for On Demand Renewal availability when evaluating cycles involving shorter months
• WHMCS-20046 — Itemize changes to invoices in system activity log

Modules #

• MODULE-7801 — Correct formatting of SSL information during automated installation on DirectAdmin
• MODULE-8020 — Correct Metric Items labels for DirectAdmin
• MODULE-8161 — Correct admin contact organization for CentralNIC Reseller
• MODULE-8167 — Improve resilience of gateway transition for PayPal Basic to PayPayment
• MODULE-8168 — Show Plesk service’s client custom fields and configurable options on Product Details page
• MODULE-8169 — Ensure required X-DK-* details are send during .dk registration with CentralNic Reseller
• WHMCS-21375 — Ensure the correct amount is captured by PayPal Payments when an invoice is already partially paid
• WHMCS-21702 — Update iDEAL via Mollie module to 2.0

API #

• WHMCS-19446 — Add “qty” to GetClientsProducts and GetClientsAddons API (Also known as: CORE-19446)

Was this helpful?

Last modified: 2026 November 10