This vulnerability (CVE-2026-29204) in WebPros WHMCS arises from insufficient ownership validation in the clientarea.php script. Authenticated users can manipulate the addonId parameter to access or perform actions on other users' accounts without authorization. This is classified as CWE-639 (Insecure Direct Object Reference). The vulnerability affects multiple versions of WHMCS and has a critical severity rating with a CVSS 3.1 score of 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts. No official remediation or patch has been disclosed by the vendor as of the published date.

Successful exploitation allows an authenticated user to access or manipulate another user's account data or resources without authorization, compromising confidentiality and integrity of user accounts. This could lead to unauthorized data disclosure or modification within the WHMCS platform. Availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the client area to trusted users only and monitor for suspicious activity related to addonId parameter usage. Avoid sharing authentication credentials and consider additional application-layer access controls if possible.