A flaw in XenForo versions prior to 2.3.7 permits a call to methods from within templates without the stricter first-word check that should limit them. This omission lets an attacker invoke arbitrary functions that are normally protected, which can lead to code execution or other unauthorized actions. The weakness is a code injection issue identified as CWE‑94, reflecting an improper validation of code that causes unintended functionality.

The vulnerability affects the XenForo forum software, specifically installations running any version before 2.3.7. Administrators of these sites, including custom‑template developers, are potentially vulnerable if they allow template editing by non‑trusted users or have exposed template files. The issue stems from the server‑side template rendering engine that processes user‑supplied content.

The CVSS base score of 8.7 indicates a high severity, and the absence of an EPSS score or KEV listing suggests that exploitation is possible but no publicly confirmed exploits are documented. The likely attack vector is via crafting a template or post that includes a malicious method call, which would be processed on the server as part of rendering. Successful exploitation would grant the attacker elevated privileges or arbitrary code execution depending on the methods available in the environment.