EUVD-2026-72786
GHSA-x4fx-w4wf-c38c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated endpoint, no complexity; scope changes to subsequent cloud systems with high confidentiality loss via IAM credentials; no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme, hostname, or allowlist validation. Attackers can submit a crafted POST to the PayPal webhook callback endpoint to reach internal network resources including cloud instance metadata services, potentially disclosing IAM credentials or enabling secondary internal service exploitation.
AnalysisAI
Server-Side Request Forgery in XenForo's PayPal REST webhook handler enables unauthenticated remote attackers to coerce the application server into making arbitrary outbound HTTP requests by supplying a crafted certificate URL in webhook request headers. All XenForo versions prior to 2.3.13 are affected due to the absence of scheme, hostname, or allowlist validation on the attacker-controlled URL. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only the ability to send an unauthenticated HTTP POST to the XenForo PayPal REST webhook endpoint, which is publicly internet-accessible on any XenForo installation with PayPal REST payment processing configured and active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully automated, unauthenticated, zero-complexity remote exploitation - the PayPal webhook endpoint is publicly accessible by design, removing all network-layer barriers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade XenForo to version 2.3.13 or later; this release introduces scheme, hostname, and allowlist validation for the PayPal webhook certificate URL parameter and is available from https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all XenForo deployments to identify instances running versions prior to 2.3.13, with particular attention to any hosted on AWS, GCP, or Azure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Xenforo before 2.2.16 allows code injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Xenforo before 2.2.16 allows CSRF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authen
Authentication bypass in XenForo versions prior to 2.3.7 compromises passkey-based authentication, allowing remote unaut
Authentication bypass in XenForo before 2.3.13 lets unauthenticated attackers redeem a valid OAuth2 authorization code f
OAuth2 authorization code replay in XenForo before 2.3.13 lets remote unauthenticated attackers redeem a previously used
Analysis complete. The JSON synthesis is above. Two things worth flagging explicitly: 1. **Prompt injection ignored**
In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertisi
Unauthenticated payment event forgery in XenForo before 2.3.13 stems from a logic error in the PayPal REST webhook signa
Unauthorized subscription upgrades in XenForo before 2.3.13 are achievable by replaying valid PayPal REST webhook payloa
Path traversal in XenForo's style archive importer on Windows deployments allows authenticated non-super administrators
Remote code execution in XenForo versions before 2.3.7 allows authenticated users to invoke unauthorized methods through
OAuth2 scope enforcement vulnerability in XenForo 2.3.x (prior to 2.3.5) allows authenticated client applications to req
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today