CVE-2026-16037: CWE-208 Observable timing discrepancy in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module

This vulnerability in the PayTR Virtual Pos iFrame API WHMCS Module allows an attacker to observe timing discrepancies that can be exploited for black box reverse engineering. The affected versions are from 9.0.0 before 9.0.3. The CVSS v3.1 score is 7.5, indicating high severity, with an attack vector of network, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality. No integrity or availability impact is reported. No vendor advisory or patch information is provided.

An attacker can exploit timing discrepancies to gain information about the internal workings of the PayTR Virtual Pos iFrame API WHMCS Module, potentially leading to reverse engineering of the system. This compromises confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates and consider limiting exposure until a fix is available.