WHMCS 9.0.2 Security Update

9.0 Change Log

WHMCS is working to improve the quality and availability of our supported languages. As a result, this and future WHMCS releases will include more updates and additions to localization files in the /lang and /admin/lang directories.

• These changes will not appear in the list of changelog entries.
• If you customize these files, we recommend reviewing the language string changes in each new WHMCS release before you update.

Version 9.0.9 (Maintenance) #

Implemented #

• WHMCS-26614 — Improved caching of MarketConnect service data

Maintenance #

• WHMCS-28262 — Improved ordering of services on the admin MarketConnect page

Modules #

• WHMCS-27404 — Update to XML RPC protocol version to 1.6.9.1 in Plesk

Version 9.0.8 (Maintenance) #

Maintenance #

• WHMCS-27923 — Security Fix for CVE-2026-67399

Modules #

• WHMCS-27532 — Update Suspension and Unsuspension in Plesk
• WHMCS-27812 — Update Change Password in Plesk
• WHMCS-27908 — Security Fix for CVE-2026-67398

Version 9.0.7 (Maintenance) #

Implemented #

• WHMCS-26198 — IP allow list for cron task invocation via HTTP request

Maintenance #

• WHMCS-25580 — Improved handling of deleted credit/debit notes in Client Statement
• WHMCS-25637 — Improved security around email previews
• WHMCS-26193 — Undisclosed Security Fix
• WHMCS-26201 — Update the jms/serializer library
• WHMCS-26284 — Add System Health Check notice if deprecated modules are found
• WHMCS-26336 — Improved handling of Invoice Creation Hook when merging Invoices.
• WHMCS-26382 — Undisclosed Security Fix
• WHMCS-26464 — Block direct access to email campaign and hidden Knowledgebase image attachments
• WHMCS-26502 — Undisclosed Security Fix
• WHMCS-26653 — Resolve ArgumentCountError error on 360 Monitoring Landing page
• WHMCS-27325 — Improve handling of invalid data during null-IV migration

Modules #

• WHMCS-26200 — Improved encryption method for callbacks in GoCardless
• WHMCS-26360 — Undisclosed Security Fix
• WHMCS-26381 — Improved security for paying invoices with PayPal Payments
• WHMCS-26480 — Remove Hipchat Notification Module
• WHMCS-27149 — Undisclosed Security Fix
• WHMCS-27204 — Improved payment capture logic in Admin Area for Stripe Dynamic Payment Gateway

Version 9.0.6 (Maintenance) #

Maintenance #

• WHMCS-25193 — Define a default region for S3-compatible Storage Providers
• WHMCS-25216 — Correct invoice chunking logic
• WHMCS-25397 — Improved error handling for ReCaptcha v2 and v3
• WHMCS-26068 — Undisclosed Security Fix
• WHMCS-26192 — Improved security around Admin password resets.
• WHMCS-26194 — Improved security around User password resets.
• WHMCS-26206 — Improved security around Invoice processing Hook Points
• WHMCS-26338 — Improved security around User logouts.
• WHMCS-26339 — Admins require “View Clients Summary” permission to download client files
• WHMCS-26425 — Undisclosed Security Fix
• WHMCS-26466 — Persist Sign-In Integration notice when appropriate
• WHMCS-26624 — Undisclosed Security Fix

Modules #

• WHMCS-24791 — Improved security for paying invoices with Stripe
• WHMCS-26067 — Improved security for paying invoices with PayPal Basic
• WHMCS-26381 — Improved security for paying invoices with PayPal Payments
• WHMCS-26444 — Improved security of logging in WorldPay FuturePay
• WHMCS-26566 — Corrected variable name for Enom

Version 9.0.5 (Maintenance) #

Maintenance #

• WHMCS-22846 — Improve product downgrade credit calculation
• WHMCS-25235 — Undisclosed Security Fix
• WHMCS-25253 — Undisclosed Security Fix
• WHMCS-25271 — Add validation Improvements in Admin Area
• WHMCS-25272 — Undisclosed Security Fix
• WHMCS-25466 — Resolved ClassLoader error during system updates
• WHMCS-26014 — Undisclosed Security Fix
• WHMCS-26057 — Undisclosed Security Fix
• WHMCS-26073 — Improved encryption method for sensitive data storage
• WHMCS-26075 — Increased randomness of guest ticket access key generation
• WHMCS-26189 — Undisclosed Security Fix

Modules #

• WHMCS-26044 — Undisclosed Security Fix
• WHMCS-26056 — Undisclosed Security Fix
• WHMCS-26058 — Undisclosed Security Fix
• WHMCS-26060 — Undisclosed Security Fix
• WHMCS-26061 — Undisclosed Security Fix
• WHMCS-26063 — Undisclosed Security Fix
• WHMCS-26066 — Undisclosed Security Fix
• WHMCS-26072 — Undisclosed Security Fix
• WHMCS-26074 — Undisclosed Security Fix
• WHMCS-26079 — Undisclosed Security Fix
• WHMCS-26145 — Remove Asiapay, Gate2shop, Inpay & Paypoint from distribution
• WHMCS-26261 — Improve security around Reports

Version 9.0.4 (Maintenance) #

Maintenance #

• WHMCS-26041 – Security Fix for CVE-2026-29204

Version 9.0.3 (Maintenance) #

Maintenance #

• WHMCS-19418 — Updated Setup Tasks List
• WHMCS-25024 — Improved session handling in the Client Area Nexus Theme
• WHMCS-25168 — Improved System Health checks for supported PHP versions
• WHMCS-25243 — Improved usage of customer currency when viewing Invoices from the Admin Area
• WHMCS-25258 — Improvements to Digicert SSL expiry handling
• WHMCS-25386 — Improved error handling for Activity Logs
• WHMCS-24954 — Improved error handling in the Nexus Cart

Modules #

• WHMCS-25082 — Introduced new Stripe Dynamic Payments Gateway Module

Version 9.0.2 (Maintenance) #

Maintenance #

• WHMCS-25228 — Resolved a bug that allowed for cancelled services to be erroneously renewed
• WHMCS-25250 — Improved error handling during Invoice generation
• WHMCS-25002 — Improved error handling during OAuth authentication calls
• WHMCS-22710 — Undisclosed Security Fix
• WHMCS-25149 — Improved handling of Late Fees for Mass Pay Invoices
• WHMCS-24960 — Improved handling of Domain Addons in the Nexus Cart template

Version 9.0.1 (Maintenance) #

Maintenance #

• WHMCS-17812 — Improved error handling for Stripe and Invisible reCaptcha
• WHMCS-24655 — Improved authentication handling for Nexus Cart when masquerading as a client from the Admin Area
• WHMCS-24830 — Improved handling of products with inclusive tax in Nexus Cart
• WHMCS-24842 — Expand graceful handling of unsupported Smarty tags
• WHMCS-24913 — Improved directory path references for Nexus Cart
• WHMCS-24930 — Improved visibility of product renewals in the Nexus Cart
• WHMCS-24931 — Improved handling of existing Invoice Late Fees when upgrading to version 9.0
• WHMCS-24932 — Improved how Sign-In Integrations are handled
• WHMCS-24935 — Improved handling of product deletions in the Nexus Cart
• WHMCS-24936 — Improved authentication handling in Nexus Cart
• WHMCS-24949 — Exclude Billing Notes from Admin Area income statistics
• WHMCS-24950 — Exclude Billing Note Transactions from Cashflow Reports
• WHMCS-25006 — Improved handling of URL Rewrites for Nexus Cart

Version 9.0.0 (General Availability) #

Maintenance #

• WHMCS-22723 — Add validation improvements in admin area
• WHMCS-23275 — Add NORD VPN Landing and Branding Update
• WHMCS-24649 — Remove Basic Authentication for Google Mail Provider
• WHMCS-24708 — Prevent error when clicking “View all pricing” in the Client Area
• WHMCS-24841 — Improve error handling when upgrading from 7.x to 9.0
• WHMCS-24847 — Add validation Improvements in Admin Area
• WHMCS-24862 — Improve rendering of Free Products in Nexus Cart
• WHMCS-24863 — Correct Document Type & Description on Debit Note
• WHMCS-24865 — Remove TrustCommerce gateway module
• WHMCS-24901 — Improve dependency handling during upgrade process
• WHMCS-24643 — Correct system path references in Nexus
• WHMCS-24694 — Correct formatting of Client Area Invoice in Nexus Theme
• WHMCS-24913 — Correct fixed directory path references in Nexus Cart JS

API #

• WHMCS-24834 — Improve error handling with Domain Transfers and Domain Renewals when using the API

Version 9.0.0 (Release Candidate) #

Implemented #

• WHMCS-20052 — Improve Domain Discoverability through AI Powered Namespinning
• WHMCS-20187 — Expand API Coverage for Buy Flow Cart Management
• WHMCS-22591 — Upgrade Smarty template engine to v4
• WHMCS-22633 — Improve VAT Compliance and Validation During Checkout
• WHMCS-22711 — Add ImportAssist Support for CSV Imports of Customer Accounts
• WHMCS-23171 — 2026 Client and Buy Flow Theme
• WHMCS-23462 — Credit Note Support for WHMCS
• WHMCS-23658 — Digicert Certificate Provisioning Adjustments to Support Shorter SSL Certificate lengths

Maintenance #

• WHMCS-10754 — “Open” ticket counts in sidebar only include tickets from admin’s assigned departments
• WHMCS-12696 — Configurable option pricing is now properly displayed in emails
• WHMCS-13425 — Add clarifying messaging on Integration Links regarding Captcha (Also known as: WHMCS-14677)
• WHMCS-16768 — Improve Password Reset error messaging when a password does not meet minimum security requirements
• WHMCS-19165 — Fix the spelling of the Portuguese language in various Admin Area dropdowns (Also known as: CORE-19165)
• WHMCS-19395 — Fix a bug related to undercharging a client when performing certain prorated addon actions
• WHMCS-19956 — Validation improvements in admin area
• WHMCS-22024 — Add Captcha Protection to Password Reset form
• WHMCS-21192 — Remove the Trust Commerce Gateway Module (Also known as: WHMCS-21175)
• WHMCS-21712 — Improve Staff Online header functionality in Blend – Preview theme
• WHMCS-21765 — Secret Word is now required when configuring Skrill Hosted Payment
• WHMCS-21795 — Upgrades and downgrades now validate resources to prevent overages
• WHMCS-21897 — Visual updates to the Marketgoo landing page and reseller modal
• WHMCS-21993 — EmailPreSend Hook Now Supports File Attachments
• WHMCS-22177 — More MarketConnect offerings are now back compatible
• WHMCS-22217 — Add the ability to select a default language in the “Getting Started Wizard”
• WHMCS-22230 — Scheduled action controls now visually represent the permissions a user has
• WHMCS-22289 — Prevent “Oops” error when attempting to “Login as Owner” as an Admin related to custom child themes
• WHMCS-22290 — Fix a bug related to duplication of Activity Log entries when using the TPP Wholesale registrar module
• WHMCS-22303 — Add System Health Check notice if plain-text TOTP tokens are found
• WHMCS-22313 — Correct redirect for “Create Upgrade/Downgrade Orders” action without the required permissions
• WHMCS-22474 — Validation improvements in admin area
• WHMCS-22505 — New User Passwords are Limited to a Maximum of 100 Characters
• WHMCS-22534 — Fix a bug to prevent invalid response messages when performing Domain Lookup search for various TLD’s (Also known as: WHMCS-22832)
• WHMCS-22694 — Validation improvements in admin area
• WHMCS-22702 — Fix a bug in the Domain Registrar Module code to prevent invalid “Oops” errors when performing a domain lookup
• WHMCS-22705 — Update clientsummary.tpl admin template
• WHMCS-22703 — Validation improvements in admin area
• WHMCS-22707 — Validation improvements in admin area
• WHMCS-22837 — Update firebase/php-jwt library
• WHMCS-22838 — Update the league/flysystem library
• WHMCS-22839 — Update the phpmailer/phpmailer library
• WHMCS-22840 — Update the minimist library
• WHMCS-22841 — Update the underscore.js library
• WHMCS-22856 — Getting Started Wizard will now set the Default Language for the system instead of just setting it for the current Admin User
• WHMCS-23184 — Add dropdown to Admin Area VAT Validation settings
• WHMCS-23264 — Prevent erroneous CSRF block when accessing MarketConnect services (Also known as: WHMCS-22861)
• WHMCS-23628 — Fix a bug where sending Custom Messages and Email Campaigns did not properly parse Smarty Tags
• WHMCS-23636 — Remove the “Allow Smarty Tags” setting from Configuration Settings
• WHMCS-23674 — Fix a bug in the AddClient API Endpoint to resolve invalid entries when both firstname and lastname fields are NULL
• WHMCS-23711 — Add the ability to save a Product Group Icon under the Product Group settings page
• WHMCS-24369 — Fix a bug with the Support Menu dropdown
• WHMCS-24500 — Add language translations for Social Bee in the Client Area (Also known as: WHMCS-22300)
• WHMCS-24540 — Enable product group icons for all themes

Modules #

• WHMCS-18868 — Improve error handling when viewing the “Transactions” page in the Admin Area while an active Payment Gateway’s files are missing
• WHMCS-21227 — Improve error handling of .ca domain transfers when using the GoDaddy Registrar Module (Also known as: MODULE-7931)

Languages #

• WHMCS-19692 — Fix a bug that was preventing Invoices from using the default language set by the Admin when downloading

Was this helpful?

Last modified: 2026 November 10