CVE-2026-73315

XenForo before 2.3.13 contains a server-side request forgery (SSRF) flaw in its PayPal REST webhook handler, which accepts a certificate URL from webhook headers without validating the scheme, hostname, or an allowlist. An unauthenticated attacker can send a crafted POST to the PayPal webhook callback endpoint, causing the forum server to issue outbound HTTP requests to attacker-chosen destinations. This can reach internal network resources, including cloud instance metadata services, potentially disclosing IAM credentials or enabling attacks on other internal services. Any XenForo deployment running an affected version with the PayPal webhook callback endpoint reachable is exposed, with the greatest impact on cloud-hosted instances. No confirmed in-the-wild exploitation is reported; a public proof-of-concept exists and EPSS currently estimates only about a 0.3% probability of exploitation within 30 days.

What to do: Upgrade XenForo to 2.3.13 or later. As interim mitigation, restrict outbound HTTP from the forum server (especially to link-local metadata addresses such as 169.254.169.254) and disable or firewall the PayPal webhook callback endpoint if PayPal REST payments are not in use; also check inbound logs for unexpected POSTs to the webhook route and outbound logs for unexplained requests to internal addresses.