The vulnerability in the PayTR Virtual Pos iFrame API WHMCS Module is a use of less trusted source flaw that allows an attacker to influence how client IP addresses are trusted, leading to exploitation of trusted identifiers. This weakness is identified as CWE-348. The effect is that an attacker could spoof the IP address reported by the module, undermining IP‑based access controls and potentially permitting unauthorized transactions.

Affected systems are PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module versions from 9.0.0 through 9.0.2. Administrators running these module versions on WHMCS installations should be aware that the flaw remains until an updated release such as 9.0.3 is applied.

The CVSS score of 9.1 indicates critical severity, while the EPSS score of less than 1% shows a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker would need to send requests to the module over the network, but the specific attack vector is not detailed in the data. The high CVSS value combined with the potential for IP spoofing implies significant risk should the flaw be exploited.