The vulnerability is an OS command injection in Softaculous Virtualizor’s billing module. Attackers can send a crafted billing_data POST field that includes malicious shell commands in the uid field. Because the uid value is forwarded unchanged to proc_open via the internal vexec function, the attacker can execute arbitrary commands with root privileges. This provides full control over the host system and all virtual private servers hosted by Virtualizor. The flaw belongs to CWE-78.

The flaw affects Softaculous Virtualizor software versions prior to 3.2.9 Patch 9 and any release in the 3.0.0 branch. Administrators should check that their instance is running a patched or newer version of Virtualizor.

The CVSS score of 9.3 indicates critical severity, and the EPSS score of 3% indicates a very low exploitation probability, but the high score signals a severe vulnerability. The flaw is exploitable by unauthenticated remote attackers, requiring only an HTTP POST to the billing endpoint; no prior authentication or privileged user access is necessary. Because the executed commands run as root, the potential impact is total compromise of the host and any hosted VPS instances. The vulnerability is currently not listed in the CISA KEV catalog, indicating no confirmed exploits yet, but the known exploitation vector warrants immediate attention.