This vulnerability (CVE-2026-29204) in WebPros WHMCS arises from improper authorization checks in clientarea.php, specifically lacking validation of ownership for addonId parameters submitted by authenticated users. This insecure direct object reference (CWE-639) allows attackers to access resources and cPanel accounts belonging to other users. The flaw affects multiple versions of WHMCS and has a critical CVSS 3.1 score of 10. The vulnerability is network exploitable without user interaction and requires no privileges, making it highly severe. No patch or official remediation level has been published by the vendor as of the current data.

Successful exploitation allows an authenticated client area user to bypass ownership validation and access another user's resources and cPanel account, compromising confidentiality and integrity of sensitive data. The vulnerability does not impact availability. Given the critical CVSS score of 10, the impact is severe, potentially leading to full compromise of victim accounts within WHMCS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the client area to trusted users only and consider additional monitoring for suspicious activity related to addonId parameters. Avoid exposing WHMCS client area interfaces to untrusted networks. Follow vendor advisories closely for updates on patches or mitigations.