CVE-2026-73316: XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate payment events, resulting in repeated subscription activations and unauthorized account upgrades.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
XenForoto a version that resolves this vulnerability.Fixed in 2.3.13 - Compensating control
Apply a duplicate-transaction guard for PayPal REST webhook handling by enforcing a missing duplicate transaction ID check (reject webhook processing when the transaction ID was already processed) until XenForo is upgraded to 2.3.13.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
XenForo versions before 2.3.13 are affected when they use the PayPal REST payment provider. The issue concerns processing of PayPal REST webhook payloads.
What does an attacker need to exploit it?
An attacker needs a valid webhook payload that can be replayed. No authentication, user interaction, or complex exploitation conditions are indicated by the supplied severity vector.
What is the practical impact of a successful replay?
Replaying the same payload can trigger duplicate payment events. This can cause repeated subscription activations and unauthorized account upgrades.
How can administrators determine whether they may be affected?
Check whether the XenForo installation is earlier than 2.3.13 and whether the PayPal REST payment provider is enabled or used for payment processing. Review payment and subscription records for repeated processing associated with the same transaction or webhook payload.