Description

XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate payment events, resulting in repeated subscription activations and unauthorized account upgrades.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-08T14:17:25.923Z",
  "pubdate": "2026-09-08T14:17:25.923Z",
  "executiveSummary": "XenForo versions prior to 2.3.13 are susceptible to a payment replay vulnerability within the PayPal REST payment provider component. This vulnerability stems from a failure to validate the uniqueness of transaction identifiers contained within incoming webhook payloads.\nThe flaw allows remote attackers to intercept and re-submit valid, previously processed webhook notifications. By replaying these payloads, an attacker can trick the application into re-processing successful payment events, leading to unauthorized account upgrades, extended subscription periods, or the repeated triggering of automated service provisioning logic.\nThe risk implication is significant for service-oriented platforms that rely on automated payment verification for digital asset delivery or membership access. Exploitation does not require prior authentication, as the attack is directed at the public-facing webhook endpoint. Successful exploitation enables unauthorized financial and operational gain by bypassing the system's idempotent transaction logic.",
  "technicalDetails": "The root cause of this vulnerability is the absence of an idempotency mechanism or a transaction ID tracking ledger within the XenForo PayPal REST payment processing workflow. When PayPal sends a webhook notification to the XenForo instance, the application processes the POST payload to verify payment completion and update the subscriber's status. Because the application logic fails to verify whether a specific transaction ID has already been successfully committed to the database, it treats every incoming request as a unique, legitimate event.\nThe attack flow begins with an attacker capturing a valid webhook notification from PayPal, typically via network interception or by initiating a legitimate transaction that they control. Once the attacker possesses the raw, signed webhook payload, they can repeatedly transmit this payload to the XenForo webhook endpoint using standard HTTP requests. The XenForo server receives the replayed payload and, lacking a check against a history of processed transaction IDs, processes the request as a new payment verification event.\nThe vulnerable component is the PayPal REST payment integration layer. The system relies solely on the integrity of the data packet rather than ensuring state-based idempotency. Consequently, the application consistently triggers secondary processing logic—such as database updates for user group modifications, license extensions, or subscription expiration adjustments—each time the payload is accepted.\nExploitation requires no authenticated access, as webhook endpoints are exposed for external callback handling. Because the attack relies on the server’s willingness to process a previously 'seen' transaction ID, it effectively circumvents the security logic intended to prevent double-spending or duplicate fulfillment. The post-exploitation impact is characterized by the potential for mass unauthorized account upgrades or the manipulation of subscription states without corresponding financial reconciliation, potentially causing significant revenue loss or systemic abuse of the platform's payment architecture."
}