CVE-2026-73314

XenForo before 2.3.13 contains a signature verification logic error (CWE-754) in its PayPal REST webhook handler, where an unsupported auth_algo value causes the verification function to incorrectly return true instead of failing. An unauthenticated attacker can trigger this by submitting a crafted webhook request whose auth_algo header cannot be mapped to a supported hash function, so the fabricated request is treated as verified. The attacker gains the ability to process forged PayPal payment events — such as fake subscription payments or completed invoices — without holding a valid PayPal signature, which can grant paid memberships or unlock paid content for free. Any XenForo deployment on an affected version that uses the PayPal REST webhook path for payments is affected. A public proof-of-concept exists on GitHub, but exploitation has not been confirmed in the wild; EPSS is low (0.5%, 38th percentile) and the flaw is not in CISA KEV.

What to do: Upgrade XenForo to 2.3.13 or later, which corrects the webhook signature verification logic. Until patched, restrict access to the PayPal webhook endpoint (e.g., by allowlisting PayPal IP ranges at the web server or reverse proxy) and review recent payment/subscription records for events that were accepted without a valid PayPal signature, particularly any with unusual or unsupported auth_algo values. Administrators not using PayPal paid subscriptions have minimal exposure from this flaw.