A flaw in XenForo’s admin interface allows an authenticated, malicious administrator to execute arbitrary code on the server, turning any admin account into an execution vector. This weakness corresponds to a code injection vulnerability (CWE‑94). Successful exploitation grants a malicious user full control over the hosting environment, jeopardizing confidentiality, integrity, and availability.

The vulnerability applies to XenForo forum software released before version 2.3.9 or 2.2.18. Any installation running those releases and possessing an admin account is susceptible, regardless of network exposure.

The flaw scores 8.6 on the CVSS scale, indicating high severity, while the EPSS score is below 1 %, implying a low likelihood of immediate exploitation, and it is not listed in CISA’s KEV catalog. The attack vector is likely confined to the authenticated admin panel, so an attacker must first acquire or trick an admin into logging on; after that, arbitrary code can be run on the server, giving system‑wide privileges.