Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.7

XenForo allows attackers to reach internal services via PayPal webhook

CVE-2026-73315 · published 1 month ago
Summary

Versions of XenForo older than 2.3.13 can be tricked into sending web requests to any address when processing PayPal webhook messages. This can let outsiders contact internal servers, such as cloud metadata services, and potentially expose sensitive credentials. Update XenForo to version 2.3.13 or newer and verify that webhook handling is properly restricted.

What to do
  • Update xenforo xenforo to version 2.3.13 or later.
Affected software
VendorProductAffected versions
xenforo xenforo < 2.3.13
Original advisory text
XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme, hostname, or allowlist validation. Attackers can submit a crafted POST to the PayPal webhook callback endpoint to reach internal network resources including cloud instance metadata services, potentially disclosing IAM credentials or enabling secondary internal service exploitation.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published8 Sep 2026
Updated4 Nov 2026
First seen8 Sep 2026
Sources
CVE-2026-73315 · NVD
CVE-2026-73315 · MITRE
Track software like this
Free during beta