The vulnerability is an authorization bypass in the billing module handler of Softaculous Virtualizor. It permits unauthenticated attackers to send a crafted POST request containing arbitrary uid and balance values, which the system then uses to perform an unchecked UPDATE on the users table. The result is that an attacker can inflate or deflate any tenant’s account balance, potentially leading to service suspension or financial loss. This flaw is driven by improper access control (CWE-862).

Softaculous Virtualizor versions prior to 3.2.9 Patch 9 and 3.0.0 are affected. Vendors have released patched versions in the 3.2.9 (Patch 9) and 3.3.0 releases that eliminate the bypass. Systems running any earlier major or patch release remain vulnerable.

The flaw can be exploited remotely without authentication by posting to the admin dispatcher endpoint. Although no EPSS data is publicly available, the CVSS score of 8.7 indicates a high severity. The vulnerability is not listed in CISA's KEV catalog, but the lack of a known exploitation probability does not reduce the risk. Attackers can target any accessible instance of Softaculous Virtualizor, making the impact potentially widespread. The likely attack vector is inferred from the description because it describes a POST request to the admin panel dispatcher, and no explicit entrance points are enumerated in the available data.