Insufficient ownership validation on the WHMCS client area page allows an authenticated client to submit a request specifying another user's addon identifier. The missing check lets the attacker gain access to the victim's cPanel resources and associated files, effectively bypassing authorization controls. This flaw is a classic example of CWE‑639, where user‑controlled input is not properly verified before use.

The vulnerability affects WebPros' WHMCS product. Any configuration using the default client area implementation where 'clientarea.php' is exposed to authenticated users is susceptible. The issue specifically relates to operations involving addon identifiers submitted via HTTP requests. No specific version data is disclosed in the advisory.; therefore, support for earlier or unpatched versions remains uncertain.

The CVSS score of 9.1 indicates a critical condition. While the EPSS score is not available, the lack of a public exploit‑related warning and the fact that the issue is not listed in CISA’s KEV catalog suggest the exploitability is high but not yet confirmed in the wild. Attackers must be authenticated users of the WHMCS client area to exploit this flaw, inferred from the description. Once authenticated, the attacker can manipulate the addonId parameter, bypassing ownership checks and gaining unauthorized access to the victim’s cPanel account and resources.