Executive brief
XenForo is a popular online community platform that processes payments through PayPal integration. This vulnerability allows attackers to forge PayPal payment notifications to extend user subscriptions without paying. A buyer with an active subscription could submit fake payment confirmations and extend their access indefinitely, bypassing PayPal's cryptographic signature verification that normally protects against this attack.
Technical details
The vulnerability is a signature verification logic error in XenForo's PayPal REST webhook handler (PayPalRest::verifyWebhookSignature()). When a webhook arrives with an unsupported PAYPAL-AUTH-ALGO header value, the code fails to map it to a supported hash function, leaving the algorithm variable unset. Instead of rejecting the request, the verification function logs that the algorithm is unavailable and incorrectly returns true, causing the webhook processor to treat the unverified request as legitimate. An unauthenticated attacker with knowledge of an active recurring upgrade (available through the upgrade management UI) can craft a forged PAYMENT.CAPTURE.COMPLETED callback with an arbitrary unsupported algorithm header and the correct purchase key to extend the subscription without a valid PayPal signature. The fix in XenForo 2.3.13 explicitly rejects unsupported algorithms instead of treating them as successful verification.
Affected products
- XenForo XenForo before 2.3.13
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: XenForo 2.3.13 released