Is CVE-2026-73315 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73315 being exploited in the wild.

How severe is CVE-2026-73315?

High severity, with a CVSS score of 8.6, published 8 September 2026.

Is there a fix for CVE-2026-73315?

A patch was published on 2026-09-08: XenForo 2.3.13 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73315 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-73315?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73315: XenForo server-side request forgery in PayPal webhook handler

CVE-2026-73315 · Severity: high · CVSS 8.6 · Published 2026-09-08

XenForo is a community forum and discussion platform. The PayPal webhook handler in versions before 2.3.13 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to make the XenForo server fetch arbitrary URLs by crafting malicious webhook requests. This can expose internal network resources, cloud metadata services, and IAM credentials, or enable lateral movement to other internal systems.

Quick answers

Is CVE-2026-73315 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73315 being exploited in the wild.
How severe is CVE-2026-73315?: High severity, with a CVSS score of 8.6, published 8 September 2026.
Which products and versions are affected?: XenForo XenForo before 2.3.13.
Is there a fix for CVE-2026-73315?: A patch was published on 2026-09-08: XenForo 2.3.13 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73315 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-73315?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the PayPal REST webhook handler, which blindly fetches the URL supplied in the PAYPAL-CERT-URL webhook header without validating the destination or requiring PayPal hostname constraints. The HTTP/HTTPS GET request is issued before the webhook signature is verified, allowing unauthenticated attackers to reach internal network addresses, localhost, and cloud metadata endpoints. Attackers can exploit this via a POST to the PayPal webhook callback endpoint with a crafted PAYPAL-CERT-URL header pointing to attacker-controlled or internal destinations. The fix in XenForo 2.3.13 restricts certificate retrieval by validating URLs and likely adding an allowlist of permitted destinations.

Affected products

XenForo XenForo before 2.3.13

Timeline

2026-09-08: disclosed
2026-09-08: patched: XenForo 2.3.13 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.