Vulnerability · Published Sep 22, 2026 · Assigned by VulnCheck

CVE-2026-43643Softaculous Virtualizor Authorization Bypass via Billing Module Handler

High 7.5

In plain English

A high-severity missing authorization in Virtualizor from Softaculous. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 49.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and from_billing_module parameters to the admin panel dispatcher. Attackers can send a POST request with arbitrary uid and balance values in the billing_data field to trigger an unauthenticated parameterized UPDATE against the users table, enabling account balance manipulation and potential automated service suspension for targeted accounts.

Affected products (as reported)

Vendor	Product	Versions
Softaculous	Virtualizor	0 – before 3.2.9 (Patch 9)

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

VulnCheck Blog technical-description, exploit
3.2.9 Patch 9 Release Notes release-notes, patch
3.3.0 Release Notes release-notes, patch
https://www.vulncheck.com/advisories/softaculous-virtualizor-authorization-bypass-via-billing-module-handler third-party-advisory