CVE-2026-73316 XenForo CVE debrief

Who should care

Defenders responsible for XenForo installations, particularly those using the PayPal REST payment provider, should assess exposure and prioritize verification and remediation. This includes reviewing and updating payment provider configurations to prevent duplicate transactions and monitoring for suspicious payment activity and subscription activations. Security teams and vulnerability management teams should also be aware of the vulnerability and its  im

Why it matters

CVE-2026-73316 is a payment replay vulnerability in XenForo's PayPal REST payment provider that allows attackers to process the same webhook payload multiple times. Defenders responsible for XenForo installations should assess exposure and prioritize verification and remediation to prevent potential payment replay attacks and unauthorized account upgrades.

• Potential for repeated subscription activations and unauthorized account upgrades
• Need for verification and remediation to prevent payment replay attacks
• Possible impact on payment processing and account management

Technical summary

The vulnerability is caused by a missing duplicate transaction ID check in the PayPal REST payment provider of XenForo. This allows attackers to process the same webhook payload multiple times, resulting in repeated subscription activations and unauthorized account upgrades. The vulnerability has a CVSS score of 8.7 and is classified as HIGH severity. Defenders should prioritize verifying and upgrading to XenForo version 2.3.13 or later to prevent potential payment replay attacks. The vulnerability affects XenForo installations using the PayPal REST payment provider.

Defensive priority

Defenders should prioritize verifying and upgrading to XenForo version 2.3.13 or later to prevent potential payment replay attacks.

Recommended defensive actions

• Verify and upgrade to XenForo version 2.3.13 or later
• Review and update payment provider configurations to prevent duplicate transactions
• Monitor for suspicious payment activity and subscription activations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Evidence is limited to public sources and may not be comprehensive. Defenders should verify the vulnerability and assess exposure using the information provided in the CVE record and NVD entry. The vulnerability is caused by a missing duplicate transaction ID check in the PayPal REST payment provider of XenForo.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.