The vulnerability is a server‑side request forgery in the PayPal REST webhook handler. This is a CWE-918 vulnerability. An unauthenticated attacker can send a crafted POST request, supplying a certificate URL in the webhook headers that lacks an explicit scheme, hostname, or allowlist validation. This causes the XenForo server to resolve and send outbound HTTP requests to arbitrary destinations, potentially accessing internal network resources, cloud instance metadata services, or other protected endpoints.

Affected systems are XenForo forum software versions earlier than 2.3.13. Vendors and products that rely on the PayPal REST webhook feature are at risk; any environment running these older XenForo releases without the published patch is vulnerable.

The vulnerability has a CVSS score of 7.7 and is not listed in the CISA KEV catalog. With no EPSS score available, the exploitation probability remains uncertain, but the nature of the flaw allows remote external attackers to reach internal resources through a public-facing endpoint. Adequate mitigation requires applying the vendor‑issued patch or limiting the webhook endpoint’s exposure to trusted sources.