CVE-2026-73316

XenForo before 2.3.13 lacks a duplicate transaction ID check in its PayPal REST payment provider (CWE-345), so the same webhook payload can be accepted and processed multiple times. An attacker who captures or obtains a valid PayPal webhook payload can replay it against the forum's webhook endpoint over the network, with no privileges or user interaction required. Each replay triggers a duplicate payment event, causing repeated subscription activations and unauthorized account upgrades, which affects the integrity of payments and access entitlements rather than data confidentiality. Any XenForo deployment earlier than 2.3.13 that uses the PayPal REST payment provider is affected; forums using other payment providers or running fixed versions are not. Exploitation has not been reported in the wild (EPSS is 0.2%, not in CISA KEV), but a public proof-of-concept is available on GitHub.

What to do: Upgrade XenForo to version 2.3.13 or later, which adds the duplicate transaction ID check in the PayPal REST payment provider. If you cannot upgrade immediately and use the PayPal REST provider, audit payment and transaction logs for duplicate PayPal transaction IDs and review member accounts for unexpected or repeated subscription activations/upgrades. After patching, reconcile any duplicate payments with your PayPal account and revert improperly granted upgrades.