CVE Alert: CVE-2026-73315 – XenForo

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme, hostname, or allowlist validation. Attackers can submit a crafted POST to the PayPal webhook callback endpoint to reach internal network resources including cloud instance metadata services, potentially disclosing IAM credentials or enabling secondary internal service exploitation.

**Risk verdict:** High risk for internet-facing deployments, but prioritisation is urgent rather than emergency because exploitation is not reported as active; KEV, EPSS and PoC status are not provided.

**Why this matters:** An unauthenticated request can turn the application into a network relay, bypassing perimeter assumptions and exposing sensitive internal services. Realistic business impact includes theft of cloud credentials, discovery of internal infrastructure and follow-on compromise of administrative or data-bearing systems; direct defacement or outage is less likely from the stated impact profile.

**Most likely attack path:** An attacker sends a crafted network request to the payment webhook endpoint, requiring no account, user interaction or special conditions. Low attack complexity makes scanning and automation plausible; changed scope means the primary site may reach otherwise inaccessible internal services, although subsequent exploitation depends on those services’ controls.

**Who is most exposed:** Public forums with the payment integration enabled, especially cloud-hosted environments with reachable metadata services or permissive egress. Shared hosting and multi-tenant deployments may increase the blast radius.

Alert on webhook requests from unexpected sources or abnormal volumes.

Review outbound requests from the application process to private, loopback and link-local addresses.

Monitor metadata-service access and unusual credential use immediately afterwards.

Hunt for unexpected DNS resolutions and egress destinations by the web host.

Mitigation and prioritisation:

Apply the vendor security update as a high-priority change across all instances and add-ons.

Temporarily disable the affected payment integration where feasible.

Enforce egress filtering, metadata-service protections and strict proxy allowlists.

Test in staging, then confirm payment flows and logging after deployment.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.