CVE-2026-73315: XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme, hostname, or allowlist validation. Attackers can submit a crafted POST to the PayPal webhook callback endpoint to reach internal network resources including cloud instance metadata services, potentially disclosing IAM credentials or enabling secondary internal service exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
XenForoto a version that resolves this vulnerability.Fixed in 2.3.13 - Compensating control
Restrict outbound HTTP/S traffic from the XenForo server to prevent SSRF from reaching internal network resources, including cloud instance metadata services.
Event History
Frequently Asked Questions
Which deployments are exposed?
XenForo installations running a version earlier than 2.3.13 are affected where the PayPal REST webhook callback endpoint is reachable. The vulnerable handler processes attacker-supplied certificate URLs without scheme, hostname, or allowlist validation.
Does exploitation require an account or user interaction?
No. The provided vector indicates network-reachable, low-complexity exploitation with no privileges or user interaction required. An attacker can submit a crafted POST request to the PayPal webhook callback endpoint.
What can an attacker access through this flaw?
An attacker can cause the XenForo server to issue outbound HTTP requests to arbitrary destinations, including internal network resources and cloud instance metadata services. This may disclose IAM credentials or provide a path to exploit internal services.
What should be done if upgrading cannot happen immediately?
The available data does not specify a vendor-supported workaround. Restricting access to the PayPal webhook callback endpoint and preventing the server from reaching internal resources or cloud metadata services would address the described attack path, but these measures are not stated in the provided advisory data.