# CVE-2026-73316: XenForo PayPal REST webhook replay vulnerability

Source: https://junglewise.ai/threats/cve-2026-73316-xenforo-paypal-rest-webhook-replay-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-73316 · Severity: high · CVSS 7.5 · Published 2026-09-08

XenForo is a popular forum and community platform that handles user subscriptions and account upgrades through payment integrations. A vulnerability in the PayPal payment processor allows attackers who intercept a legitimate payment webhook to replay it multiple times, causing duplicate charges, repeated subscription activations, and unauthorized account upgrades. This could result in financial fraud and unauthorized service access for affected users.

## Quick answers

**Is CVE-2026-73316 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73316 being exploited in the wild.

**How severe is CVE-2026-73316?** High severity, with a CVSS score of 7.5, published 8 September 2026.

**Which products and versions are affected?** XenForo XenForo before 2.3.13.

**Is there a fix for CVE-2026-73316?** A patch was published on 2026-09-08: XenForo 2.3.13 released with transaction replay protection Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73316 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-73316?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The PayPal REST payment provider in XenForo overrides the base validateTransaction() method but omits the duplicate transaction-log lookup that the parent implementation performs. Additionally, the database index for transaction IDs is non-unique, allowing duplicate entries. An attacker with access to a valid, signed webhook payload can resend it multiple times; each replay passes signature verification and triggers purchase completion without checking if the provider event has already been processed. This results in multiple payment log entries and repeated subscription extensions. The vulnerability affects XenForo versions before 2.3.13 and requires the attacker to capture an authentic webhook callback but does not require forging signatures. Version 2.3.13 adds transaction replay protection to prevent this issue.

## Affected products

- XenForo XenForo before 2.3.13

## Timeline

- 2026-09-08: disclosed
- 2026-09-08: patched: XenForo 2.3.13 released with transaction replay protection

## References

- [https://bombobombone.github.io/posts/cve-2026-73316/](https://bombobombone.github.io/posts/cve-2026-73316/)
- [https://github.com/BomboBombone/CVE-2026-73316](https://github.com/BomboBombone/CVE-2026-73316)