WHMCS 9.0.5 Security Update

9.0.5 (Maintenance Release) Security Fixes

WHMCS 9.0.5 is a security maintenance release. It bundles a number of security hardening changes. Below is an explanation of what each fix addresses, along with the affected versions and the update path.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Improve security around Reports

Report generation now enforces the logged-in user’s permissions, preventing a low-privilege user from viewing reports they are not authorized to see.

Affected Versions and Remediation

Apply the update to the latest patch release of your WHMCS branch. WHMCS supports updating in place through the Admin Area (Utilities > Update WHMCS) or by uploading the release package. Back up both your WHMCS files and database before updating.