r/WHMCS

We are looking for some sort of Fraud Prevention for WHMCS What or which addon/program you are using for Fraud Prevention that actually works?

WHMCS addon? Has any one here actually created their own? Its becoming a real problem for us Thanks

If you run WHMCS and haven’t updated in the past week, stop reading and go do that first. Back? Good. Here’s what you just patched.

https://blog.kalfaoglu.net/posts/2026-05-17-whmcs-cve-2026-29204-idor-en/

I am all for making your product work for certain countries that require invoices to not be editable, but make it a a feature dont force it.

issues

1. cant edit invoices, i found your code to allow it for now but you are saying you will turn it off completely in a later release so first of all
   a) why do you care how a business operates their billing system, it should be our choice if we want this feature enabled or not.
   b) this should not have been enabled by default with ZERO communication about it.

c) and from your description, making changes such as billing information requires us to actually cancel the invoice and create a whole new one?? this is ridiculous and for a product that is supposed to help save time, im spending more and more time related to new "features" you keep adding.

from your docs:

>To facilitate tax law compliance and provide accurate audit trails in your system, invoices become immutable after they leave the Draft status. Due to this, you cannot directly perform any edits on published invoices.

>When you need to make changes to a published invoice, the system uses one of these approaches:

>Credit and Debit Notes — The system automatically creates these notes when you perform actions like refunds, cancellations, or applying credit. They adjust the invoice balance while preserving the original invoice.

>Reissuing Invoices — For changes to immutable fields like invoice date or tax rate, you must duplicate the invoice, make changes to the draft, publish it, and cancel the original

this creates a massive amount of extra work. not to mention all the extra cancelled invoices that will get imported into quickbooks???

2. Credits being issued for CANCELLED invoices. First of all a cancelled invoice is one that basically shouldn't exist anymore. why is a CREDIT being added to it to zero it out? that means im giving that customer a discount so will not reflect in my reporting about credits and discounts??

as per your description:

>

1. Credit Notes

>A credit note reduces or eliminates an invoice balance. Businesses use credit notes to document refunds, price adjustments, returns, or corrections after they issue an invoice.

>In WHMCS, the system creates credit notes automatically when you perform actions that would have previously reduced an invoice amount.

stop the maddness, its like you are TRYING to get people to move to a different platform forcing things on us.

Just got this email today

>Hello Tom,

>Tomorrow, May 13, 2026, we will be releasing an important maintenance update for the WHMCS 9.0 and 8.13 series. This release addresses a security vulnerability (CVE-2026-29204) which has been identified in WHMCS 7.4 and later.

>Recommended versions with required updates are WHMCS 9.0.4 and WHMCS 8.13.3 - and will be available at 19:00 PM GMT, Wednesday, May 13, 2026.

>Please note:

>This update is only available for supported WHMCS versions.

>WHMCS customers should update to one of the following versions: 9.0.4 or 8.13.3.

>We strongly recommend that all WHMCS customers prepare to update to the latest available version for their release series as soon as it becomes available.

> Prepare to Update Your WHMCS Installation:

>Self-managed WHMCS installations should be ready to update promptly once the release is available. You can update your installation using the Automatic Updater within the WHMCS admin area: Utilities > Update WHMCS.

>For those who prefer to perform updates manually, full release packages and incremental update files will be available via the WHMCS download page once the release is published.

>As always, please ensure you take a full backup of your system before performing any update.

>WHMCS Cloud Customers

>If you are using WHMCS Cloud, no action is required on your part. Your WHMCS Cloud instance is managed by WHMCS and WebPros Cloud as part of our hosted service and platform maintenance commitments. Updates are managed for you.

>  Thank you for your continued support and for being part of the WHMCS community.

If you haven't already, make sure your WHMCS install is secure. There are many ways to do this. Just make sure you're NOT using an EOL version (8.0.x and earlier)!!!