XenForo EUVD-2026-72786

Exploitation requires only the ability to send an unauthenticated HTTP POST to the XenForo PayPal REST webhook endpoint, which is publicly internet-accessible on any XenForo installation with PayPal REST payment processing configured and active. If the PayPal REST payment integration is not configured or the webhook is not registered, the handler may not be reachable, significantly reducing exposure. The highest-impact exploitation path - IAM credential disclosure - additionally requires XenForo to be hosted on cloud infrastructure (AWS, GCP, Azure, or similar) with an accessible instance metadata service endpoint at 169.254.169.254; bare-metal or on-premises deployments retain SSRF risk but lose the credential-exfiltration impact chain. No authentication, session, or elevated privilege is required at any stage of the attack.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully automated, unauthenticated, zero-complexity remote exploitation - the PayPal webhook endpoint is publicly accessible by design, removing all network-layer barriers. The impact is captured in SC:H (high confidentiality loss to a subsequent system), reflecting that the primary damage is exfiltration of cloud IAM credentials rather than data held directly on the XenForo host. The CVSS 4.0 score of 7.7 is consistent with this scoped-but-high secondary impact. EPSS data is not provided; however, the vulnerability class (SSRF to cloud metadata) is extremely well-understood by attackers, with abundant public tooling and demonstrated exploitation patterns against similar webhook handlers in other platforms. KEV status is not confirmed, and no public exploit exists at time of analysis. Real-world risk is highest for cloud-hosted XenForo deployments with PayPal REST enabled and permissive IAM roles; on-premises deployments face a reduced but non-zero risk (internal network pivoting remains possible). Defenders should not discount this due to the absence of a KEV listing - the attack is trivially constructible from the public VulnCheck advisory description.

An attacker sends an unauthenticated HTTP POST to the XenForo PayPal webhook callback URL with the webhook certificate URL header set to http://169.254.169.254/latest/meta-data/iam/security-credentials/my-role. XenForo's webhook handler fetches that address and processes the response, returning the AWS temporary credentials (AccessKeyId, SecretAccessKey, Token) to the attacker via the server's response or a side-channel observable through timing. The attacker then uses those credentials to enumerate S3 buckets, RDS instances, or other cloud resources attached to the compromised role. No public exploit code exists, but the attack is trivially constructed from the public VulnCheck advisory.