Xenforo EUVD-2025-209156

This vulnerability presents significant real-world risk despite requiring authentication (PR:L). The CVSS 4.0 score of 8.7 reflects network-accessible (AV:N), low-complexity (AC:L) exploitation with high impacts to confidentiality, integrity, and availability in the vulnerable context. No EPSS data provided, but the combination of public technical disclosure from VulnCheck, straightforward exploitation complexity, and RCE classification substantially elevates risk. The requirement for low-privilege authentication provides minimal protection since forum platforms typically allow open registration. No CISA KEV listing indicates no confirmed active exploitation campaigns at time of analysis, but the public advisory and technical details create conditions for rapid weaponization. SSVC assessment suggests medium-to-high priority: exploitation is automatable given authenticated access, technical impact enables full system compromise within the application context, and the widespread deployment of XenForo in internet-facing forums creates significant exposure. Organizations running public XenForo instances face immediate risk from authenticated threat actors.

An attacker registers a low-privilege account on a target XenForo forum and gains access to template modification features, which may be available through legitimate user customization options or add-on functionality. The attacker crafts malicious template syntax containing variable method calls designed to bypass the prefix matching restriction, invoking unauthorized PHP methods within the XenForo application context. By exploiting the loose matching logic, the attacker executes arbitrary code with the privileges of the web application, potentially reading sensitive database contents including user credentials and private messages, modifying forum content and configurations, or establishing persistent backdoor access to the server. Given the low attack complexity (AC:L) and network accessibility (AV:N), this attack can be executed remotely with minimal technical sophistication once the template injection vector is identified.