important · Edge devices
Unauthenticated requests can execute code in the WHMCS server context.
Affects
WHMCS, a web-hosting billing and customer-management application deployed on PHP web servers.
A forged request to an affected public WHMCS application reaches an executable context without credentials and runs with the web-server process's privileges.
Detail and 1 source
WHMCS has published a fix.