A flaw in the verifyiprange function of FluxCP’s PayPal IPN handler processes the X-Real-IP header incorrectly, allowing an attacker to spoof the originating IP address. The bypass of origin validation permits forged PayPal IPN messages to be accepted as genuine, potentially leading to unauthorized payment acceptance, provisioning, or other business logic execution that relies on IP validation. This directly compromises the integrity of the payment processing workflow and can result in financial loss. The vulnerability can be exploited remotely via crafted HTTP requests. The public exploit is available, meaning attackers need not develop custom vectors. The CVSS score of 6.9 indicates a moderate severity with the potential for significant impact when properly exploited.

The issue exists in rathena FluxCP up to the commit 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. No specific version numbers beyond this commit are disclosed; any deployment of FluxCP using the affected code path is vulnerable.

The CVSS base score is 6.9 and the EPSS score is not available, but the vulnerability is listed as not being included in CISA’s KEV catalog. Given that the attack vector is a simple HTTP request and the exploit is publicly documented, the likelihood of exploitation remains moderate to high in environments lacking additional network protections. Attackers only need to send a request to the IPN endpoint with a forged X-Real-IP header to trigger the validation error. Without mitigations such as stricter IP checks or header filtering, the vulnerability can be leveraged in a remote context.