Question forum for whmcs bypass with full updates

whmcs.md

Hello, welcome to this project. The purpose of this project is to track updates from the whmcsfull.com site and ensure the latest versions are made available.

I want to emphasize that this project is for educational purposes only. I do not intend to cause any inconvenience or engage in any illegal activities. My sole intention is to provide others with an opportunity to test the software. If you have the means to purchase the software officially, I encourage you to do so.

Feel free to share your ideas or questions; I will respond as soon as possible.

Best regards.

Hello,

Problem with 404 I think is not script related, but server related, and here is why: I was also constantly get 404 errors

Both on 8.13.1 and 9.0.2

First I was geting it when i click on login button in admin area, but that was my mistake, as I replaced license file only after instalation, when I did it before instalation, I did not get 404 error. Then I was geting it in admin panel when I save settings, and things like that.

And problem is cpanel OWASP mod security rules, as they were anyway last few months making me problem. Since i added to etc/apache2/conf.d/modsec/modsec2.user.conf custom rules WHMCS works normaly.

I actually thought it could be something related to server security, a missing PHP dependency, or even an issue with the site’s rewrite rules configuration.

I’ve run several tests on my server and didn’t encounter any blocks or errors, so I’m confident this is not an issue with WHMCS or the license itself. It seems much more likely to be related to the server configuration, especially security rules like ModSecurity (OWASP), as you mentioned.

I would recommend reviewing or adjusting those rules on your server, as they are likely interfering with the system requests.

I tested it on my server with WHMCS and found that the issue is caused by the cPanel ModSecurity OWASP Mod Security Core Rule Set V3.0. After running some tests, and since I use Imunify360, I have cPanel’s ModSecurity disabled. However, the problem appears to be related to Rule 921130: HTTP Response Splitting Attack.

I tested it on my server with WHMCS and found that the issue is caused by the cPanel ModSecurity OWASP Mod Security Core Rule Set V3.0. After running some tests, and since I use Imunify360, I have cPanel’s ModSecurity disabled. However, the problem appears to be related to Rule 921130: HTTP Response Splitting Attack.

This is already documented here: https://whmcs.community/topic/312082-403-504-errors-modsecurity-being-triggered/

So this isn't the first time it's happened. It's been reported before.

An what are those custom rules? Can you share them, please? Thanks.

I can post them, but they contain security risk, I can do that for me, as my server is for internal customers only.
And for me I found different rules also affecting.
But I did not found reason why is admin panel so slow, but this is all WHMCS problems generaly.

<FilesMatch "^.env">
Require all denied

SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess Off

SecPcreMatchLimit 500000
SecPcreMatchLimitRecursion 500000

SecRequestBodyLimit 134217728
SecRequestBodyNoFilesLimit 134217728
SecRequestBodyInMemoryLimit 524288
SecRequestBodyLimitAction ProcessPartial

SecAction \
 "id:900000,\
  phase:1,\
  nolog,\
  pass,\
  setvar:tx.inbound_anomaly_score_threshold=30,\
  setvar:tx.outbound_anomaly_score_threshold=30"

# Uklanjamo samo pravilo 920350 (pristup preko IP-a) jer smeta API-jima
SecRuleRemoveById 920350

<LocationMatch "/admin/configgeneral\.php">
    SecRuleRemoveById 941140 941160 941250 941260
</LocationMatch>

SecDefaultAction "phase:2,deny,log,status:403"

Nice work keeping this module up to date! For anyone using WHMCS for subscriptions, integrating crypto payments can actually simplify things a lot, accepting cryptocurrency isn’t just convenient, it opens the door to global customers, reduces fees, and streamlines recurring billing. It’s something worth exploring if you want recurring payments to just work without extra overhead.

I see have update for 9.0.3, anyone try ?

最新版本 V 9.0.3出来了，请更新下载，等候佳音。

Ola pode me enviar o licence.php

latest version 9.0.2 release 17 march 2026 on your website - but another latest is release on 31-March-2026 9.0.3. Can you please check and upload for download?
Also, on version 9.0.2 the update does not work when trying to update to latest available it says already latest version but 9.0.3 is available latest and it does not fetch any update.. what could be the issue? is this normal expected or issue?

I see have update for 9.0.3, anyone try ?

update from 9.0.2 to 9.0.3 somehow does not work. it still says no update available and everything is updated already.

I've updated the versions on the site. The update system is probably not working properly, so manual updates will need to be performed until I fix it.

Thank you @jesussuarz for your hard work and time to this project.

very strange this in version 9.0.3 when checking for updates. Latest version shows as 7.5.1 which is invalid but shows whmcs is fully updated. is this something from your error or bug in original whmcs files? thanks

anyone facing same issue of version mismatch in WHMCS Update page?

Help with releases. I need to update, but there are no releases. I need
whmcs-7.10.3-release
whmcs-8.4.1-release
whmcs-8.11.0-release
whmcs-8.13.2-release
whmcs-9.0.3-release

Help with releases. I need to update, but there are no releases. I need whmcs-7.10.3-release whmcs-8.4.1-release whmcs-8.11.0-release whmcs-8.13.2-release whmcs-9.0.3-release

It is not necessary to update the version by version, only with the last version you can update.

Please ask if the patch is still v9.0, but the official website and the update to v9.0.3 version... Will the patch still work? Thank you for your response.

anyone facing same issue of version mismatch in WHMCS Update page?

You have to click on "Check Now" button at the bottom of the Update page

@jesussuarz
Thank you for creating the update website and providing the basic patched license script.
But is there any particular reason why the license script still "calls home" to developer's servers, letting them know all the identifiable and tracking data about the installed server IP, domain, etc.?
This makes the license script not quite safe to use, it's easy for the sales/legal team to find and contact back the users of installations with this solution.
Why is that part of the script not disabled? If you need help with improving the script and disabling all the callbacks, let me know and I'll get back to you via email for more details.

Hello: A new version has been released.
whmcs 8.11.3 update

Please update V9.0.4 for security fix

Please update V9.0.4 for security fix

ready!

There is new updated available 9.0.4 but the update function still does not work in your 9.0.3 version just like in 9.0.2... can you check please? @jesussuarz

There is new updated available 9.0.4 but the update function still does not work in your 9.0.3 version just like in 9.0.2... can you check please? @jesussuarz

It is possible that the automatic update option is not working correctly. In that case, the most viable alternative would be to perform the update manually.

To do this, you can download the update package, upload the files to the server, and replace the old files with the new ones. Then, run the /install directory, which will guide you step by step through the system update process.

This official guide may be helpful as a reference:
https://docs.whmcs.com/9-0/system/updates/update-tutorials/update-in-the-browser/

Posso atualizar da versão V8.13.3 direto para V 9.0.4 só substituindo os arquivos ?
Can I upgrade directly from version V8.13.3 to V9.0.4 by simply replacing the files?

Posso atualizar da versão V8.13.3 direto para V 9.0.4 só substituindo os arquivos ? Can I upgrade directly from version V8.13.3 to V9.0.4 by simply replacing the files?

Yes,

Hello, can we perform domain verification on the following page?

https://www.whmcs.com/members/verifydomain.php/verifydomain.php

Hello, can we perform domain verification on the following page?

https://www.whmcs.com/members/verifydomain.php/verifydomain.php

Yes! You can check the domain, but the result will be negative. :)

Hello, can we perform domain verification on the following page?

https://www.whmcs.com/members/verifydomain.php/verifydomain.php

It’s ridiculous to think that a WHMCS crack could be verified on the official WHMCS website. For that to work, they would have had to hack WHMCS itself directly. I think that’s pretty obvious and just common sense.

Posso atualizar a versão V8.13.3 direto para V 9.0.4 apenas atualizando os arquivos ? Posso atualizar diretamente da versão V8.13.3 para V9.0.4 simplesmente substituindo os arquivos?

Sim,

quando substituo os arquivos ele da uma mensagem de manutenção e não sai ai tenho que voltar para a versão a sem atualizar. Saberia me dizer o que pode estar errado ?

When I replace the files, it gives a maintenance message and doesn't go away, so I have to revert to version A without updating. Do you know what might be wrong?

outra coisa é essa mensagem na versão sem atualizar
Incompatibilidade de versão do Cron PHP
Seu ambiente parece estar executando uma versão diferente do PHP (8.1.34) para o System Cron do que a versão atualmente carregada do PHP (8.3.30). Isso pode causar problemas na execução do System Cron. Saiba mais

Another thing is this message in the version without updating:
PHP ​​Cron Version Mismatch
Your environment appears to be running a different version of PHP (8.1.34) for System Cron than the currently loaded version of PHP (8.3.30). This can cause problems running System Cron. Learn more