XenForo CVE-2026-73316

Exploitation requires that the XenForo installation has the PayPal REST payment provider configured and enabled (non-default setup requiring admin configuration of PayPal API credentials). The attacker must possess at least one valid, signed PayPal REST webhook payload previously delivered to the target installation - achievable by making a legitimate minimal purchase. The webhook endpoint URL must be reachable from the attacker's network (typically public-facing by PayPal design). Exploitation is limited to the integrity domain: the attacker cannot read data or disrupt availability, only gain unauthorized subscription status. Installations using only legacy PayPal IPN or other payment providers are unaffected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) reflects a straightforward network-accessible integrity attack with no authentication or interaction requirements. In practical terms, the attacker's prerequisite is possession of a valid signed PayPal webhook body, which they can obtain by making any legitimate purchase on the target forum. Exploitation is then simple repetition of that HTTP POST. The VI:H designation is justified: repeated activation grants unauthorized premium subscription access, which has direct financial impact on the forum operator and unfair benefit to the attacker. EPSS and KEV data are not present in the supplied intelligence, and VulnCheck is the sole reporting source, so exploitation status is unconfirmed beyond the theoretical. Despite the absence of KEV listing, the low barrier to exploitation - even a mid-sized municipal IT team in leszno running a community forum on XenForo should treat this as urgent - warrants prompt patching given the direct revenue impact of unauthorized subscription grants. The 'Authentication Bypass' tag is a loose fit; the vulnerability bypasses payment integrity verification, not an authentication mechanism per se.

An attacker creates a legitimate paid account on the target XenForo forum, triggering a genuine PayPal REST webhook delivery to the site. The attacker intercepts or logs the webhook POST body (e.g., using browser developer tools, a proxy, or by hosting their own PayPal-linked account and observing the IPN flow), then replays the same signed payload to the XenForo webhook endpoint dozens of times. Each replay is accepted as a new valid payment event, granting the attacker's account repeated subscription renewals or multiple premium-tier upgrades at no additional cost.