This vulnerability in Softaculous Virtualizor allows unauthenticated remote attackers to achieve OS command injection via the billing module handler. Specifically, attackers can send a crafted billing_data POST parameter that is deserialized insecurely, enabling injection of shell commands through the uid field. The uid value is passed unmodified to proc_open() through the vexec() function, resulting in arbitrary command execution with root privileges. This compromises the host system and all VPS instances managed by the vulnerable Virtualizor installation. The flaw affects versions prior to 3.2.9 (Patch 9) and 3.0.0. The CVSS 4.0 score is 9.3, indicating critical severity.

Successful exploitation grants unauthenticated remote attackers root-level command execution on the host running Softaculous Virtualizor. This leads to complete compromise of the host system and all virtual private servers managed by the software, posing a severe risk to confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the billing module handler and monitor for suspicious POST requests containing billing_data parameters. Avoid exposing the Virtualizor management interface to untrusted networks.