XenForo CVE-2026-73314

Exploitation requires that the target XenForo installation has the PayPal REST payment processor enabled and configured (non-default for installations that never set up PayPal payments). The attacker must be able to reach the webhook endpoint over the network (AV:N). No authentication, account, or special platform access is required - the vulnerability is in the unauthenticated webhook reception path. Exploitation is limited to integrity impact: the attacker can inject forged payment events but cannot read existing payment records or cause denial of service. Installations using PayPal Standard (non-REST) or no PayPal integration are not affected by this specific handler.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly reflects that the webhook endpoint is network-accessible, requires no credentials, and demands no user interaction, making automated abuse straightforward; even a mid-sized community operator running XenForo in sopot should treat this as urgent if PayPal REST payments are enabled. The high integrity impact (VI:H) is accurate: an attacker who forges accepted payment events can fraudulently elevate their forum account tier, grant paid memberships to arbitrary accounts, or manipulate subscription state without actual financial transactions. There is no confidentiality or availability impact from this vector alone. No EPSS data is available in the supplied intelligence, and this CVE is not listed in CISA KEV, so widespread active exploitation is not confirmed. VulnCheck reported the issue, and the vendor released a patch in 2.3.13, indicating responsible-disclosure handling. The realistic risk is bounded by whether the PayPal REST payment add-on is active - installations using only PayPal Standard or no payment integration are not affected by this specific code path.

An attacker identifies a XenForo instance with PayPal REST payments enabled and sends a crafted POST request to the webhook endpoint, including a fabricated payment confirmation payload and an auth_algo header set to an arbitrary unsupported string (e.g., an invented algorithm name). The verification function fails to find a matching hash function, returns true, and XenForo processes the event as a legitimate PayPal notification - granting the attacker a paid membership or subscription upgrade without any actual payment. No public exploit code has been identified at time of analysis, but the logic is straightforward to reproduce from the public VulnCheck advisory.