A critical IDOR vulnerability in WebPros WHMCS allows unauthorized access to victim accounts, posing a severe risk to customer data privacy.

The vulnerability is an Insecure Direct Object Reference (CWE-639) located in clientarea.php. It allows an authenticated user to submit requests using an arbitrary addonId, bypassing ownership validation and granting unauthorized access to another user's account.

This vulnerability enables horizontal privilege escalation, allowing attackers to view or modify sensitive account information belonging to other customers. With a CVSS score of 9.1, the potential for mass data exfiltration and severe reputational damage is high, as WHMCS is typically used to manage sensitive billing and service data.

Immediate Action: Upgrade to the latest patched version of WHMCS (18.13.3, 9.0.4, or later as appropriate for your branch).

Proactive Monitoring: Audit web server access logs for repeated clientarea.php requests that reference varying addonId values from a single session.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block suspicious IDOR patterns or unauthorized parameter manipulation in client-side requests.

Public Exploit Available: No

Due to the critical nature of this IDOR vulnerability, administrators must apply the vendor-provided patches immediately. Failure to address this flaw could lead to a widespread compromise of customer accounts, necessitating significant incident response efforts and potential regulatory reporting.