WHMCS 9.0.7 Security Update

9.0.7 (Maintenance Release) Security Fixes

WHMCS 9.0.7 is a security maintenance release. It bundles a number of security hardening changes. Below is an explanation of what each fix addresses, along with the affected versions and the update path.

Improved security around email previews

Email previews could be used to inspect content they should not; the fix tightens access controls on the preview path so only authorized administrators can render them.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Improved security for paying invoices with PayPal Payments

The PayPal Payments gateway callback now validates the source and payload more strictly, preventing forged or replayed payment notifications.

Undisclosed Security Fix

WHMCS ships several security fixes each release without publishing technical detail. These are applied as hardening of the platform and are not accompanied by a public CVE, so the specific mechanism is withheld to protect installations that have not yet updated. Upgrading is the recommended course of action.

Affected Versions and Remediation

Apply the update to the latest patch release of your WHMCS branch. WHMCS supports updating in place through the Admin Area (Utilities > Update WHMCS) or by uploading the release package. Back up both your WHMCS files and database before updating.

Utilities → Update WHMCS (in the Admin Area)