this is the reply to my ticket from TH:
I’ve troubleshooted the situation as far as I’ve could. It appears, that your WordPress instance is recognizing the ingoing call from XenForo as being made from the IP 162..., while having an outwards facing IP of 52.... The former appears to be from cloudflare, while the latter is from amazon (I’m assuming that is your server host).
I’ve implemented a password protected workaround for now. The password is stored in both your config files (XenForo and WordPress), but I recommend that you check out if it’s possible to prevent cloudflare from masking your own servers calls, otherwise XPress won’t be able to recognize them as its own (and somewhat rightfully so, as the cloudflare machine is indeed a different one than the server itself).