CVE-2026-73316

High

Description

XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate payment events, resulting in repeated subscription activations and unauthorized account upgrades.

SeverityHigh

CVSS7.5

Exploit probability—

Product

Xenforo

PublishedSep 8, 2026

First seenSep 8, 2026

Weakness typeCWE-345CWE-345

How to fix

Update

xenforo xenforo2.3.13 or later

Patches

xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/

Vendor advisories

xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/

Affected products

Product	Affected versions	Fixed in
xenforo xenforo	v < 2.3.13	2.3.13

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.