CVE-2026-73315

HighCVSS 8.6/10Last modified Sep 11, 2026

Description

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme, hostname, or allowlist validation. Attackers can submit a crafted POST to the PayPal webhook callback endpoint to reach internal network resources including cloud instance metadata services, potentially disclosing IAM credentials or enabling secondary internal service exploitation.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
XenForo	XenForo	< 2.3.13

References

https://bombobombone.github.io/posts/cve-2026-73315/Exploit, Third Party Advisory
https://github.com/BomboBombone/CVE-2026-73315Exploit, Third Party Advisory
https://www.vulncheck.com/advisories/xenforo-ssrf-via-paypal-rest-webhook-handlerThird Party Advisory
https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/Release Notes
https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/Release Notes

Timeline

Published: Sep 8, 2026
Last modified: Sep 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-733167.5XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same CVE-2026-733172.7XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators CVE-2026-733183.8XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to CVE-2026-733196.1XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to CVE-2026-73327.2The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th CVE-2026-733206.1XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve pri CVE-2026-733216.5XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause per CVE-2026-733226.5Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is enabled, the single-s CVE-2026-733244.3Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from CVE-2026-733257.8Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arb CVE-2026-733267.6CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin set CVE-2026-733287.2Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to uploa