CVE Alert: CVE-2026-73316 – XenForo

XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate payment events, resulting in repeated subscription activations and unauthorized account upgrades.

**Risk verdict:** High risk to monetised community sites, but KEV, SSVC exploitation status, EPSS and PoC availability are not provided, so emergency urgency cannot be confirmed.

**Why this matters:** An attacker may convert one legitimate payment notification into repeated subscription or entitlement grants without needing an account. The primary business impact is financial loss, fraudulent access to premium content, reconciliation errors and possible abuse of downstream member benefits; confidentiality and service availability are less directly affected.

**Most likely attack path:** The network-reachable endpoint can be targeted remotely with low complexity, no authentication and no user interaction, provided the site accepts PayPal REST webhook traffic. Scope remains within the application, so direct host compromise or lateral movement is not indicated; however, repeated forged state changes could affect connected billing, membership and fulfilment workflows.

**Who is most exposed:** Sites using the affected payment provider for recurring memberships, subscriptions or account upgrades are most exposed, especially public forums with valuable premium tiers and limited transaction reconciliation.

payment and application logs for identical transaction IDs processed more than once.

Identify repeated webhook deliveries followed by multiple entitlement or subscription activations.

Reconcile PayPal transaction records against local payment events and membership changes.

Alert on unusual bursts of webhook requests from unexpected sources or timing patterns.

Mitigation and prioritisation:

Apply the vendor’s security update promptly; treat as high-priority maintenance.

If KEV is true or EPSS is at least 0.5, treat as priority 1.

Enforce transaction-ID idempotency and reject previously processed events.

Temporarily disable the payment integration or premium upgrades if patching is delayed, subject to change control.

Confirm webhook authenticity, logging, rollback and financial reconciliation after deployment.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.