Version 8.13.7 (Maintenance Release)
Maintenance
WHMCS-27923 — Security Fix for CVE-2026-67399
Modules
WHMCS-27908 — Security Fix for CVE-2026-67398
Version 8.13.6 (Maintenance Release)
Implemented
WHMCS-26198 — IP allow list for cron task invocation via HTTP request
Maintenance
WHMCS-25637 — Improved security around email previews
WHMCS-26193 — Undisclosed Security Fix
WHMCS-26284 — Add System Health Check notice if deprecated modules are found
WHMCS-26382 — Undisclosed Security Fix
WHMCS-26464 — Block direct access to email campaign and hidden Knowledgebase image attachments
WHMCS-26502 — Undisclosed Security Fix
WHMCS-27325 — Improve handling of invalid data during null-IV migration
Modules
WHMCS-26360 — Undisclosed Security Fix
WHMCS-26381 — Improved security for paying invoices with PayPal Payments
WHMCS-26480 — Remove Hipchat Notification Module
WHMCS-27149 — Undisclosed Security Fix
WHMCS-27204 — Improved payment capture logic in Admin Area for Stripe Dynamic Payment Gateway
Version 8.13.5 (Maintenance Release)
Maintenance
WHMCS-26068 — Undisclosed Security Fix
WHMCS-26192 — Improved security around Admin password resets.
WHMCS-26194 — Improved security around User password resets.
WHMCS-26206 — Improved security around Invoice processing Hook Points
WHMCS-26338 — Improved security around User logouts.
WHMCS-26339 — Admins require “View Clients Summary” permission to download client files
WHMCS-26425 — Undisclosed Security Fix
WHMCS-26466 — Persist Sign-In Integration notice when appropriate
WHMCS-26624 — Undisclosed Security Fix
Modules
WHMCS-24791 — Improved security for paying invoices with Stripe
WHMCS-26067 — Improved security for paying invoices with PayPal Basic
WHMCS-26381 — Improved security for paying invoices with PayPal Payments
WHMCS-26444 — Improved security of logging in WorldPay FuturePay
WHMCS-26566 — Corrected variable name for Enom
Version 8.13.4 (Maintenance Release)
Maintenance
WHMCS-25235 — Undisclosed Security Fix
WHMCS-25253 — Undisclosed Security Fix
WHMCS-25271 — Add validation Improvements in Admin Area
WHMCS-25272 — Undisclosed Security Fix
WHMCS-26073 — Improved encryption method for sensitive data storage
WHMCS-26075 — Increased randomness of guest ticket access key generation
WHMCS-26189 — Undisclosed Security Fix
Modules
WHMCS-26056 — Undisclosed Security Fix
WHMCS-26058 — Undisclosed Security Fix
WHMCS-26060 — Undisclosed Security Fix
WHMCS-26061 — Undisclosed Security Fix
WHMCS-26063 — Undisclosed Security Fix
WHMCS-26066 — Undisclosed Security Fix
WHMCS-26072 — Undisclosed Security Fix
WHMCS-26074 — Undisclosed Security Fix
WHMCS-26079 — Undisclosed Security Fix
WHMCS-26145 — Remove Asiapay, Gate2shop, Inpay & Paypoint from distribution
WHMCS-26261 — Improve security around Reports
Version 8.13.3 (Maintenance)
Maintenance
WHMCS-26041 - Security Fix for CVE-2026-2920