A critical unauthenticated remote code execution vulnerability has been discovered in vBulletin, the PHP-based forum platform still running large online gaming, automotive, tech, and support communities. The flaw — tracked as CVE-2026-61511 — lets any unauthenticated attacker run arbitrary PHP code on the server, and a public proof-of-concept exploit is now available, meaning opportunistic attacks are likely already underway.
The root cause sits in the runMaths() function, which passes user-supplied input to PHP’s eval() without adequate sanitization. Attackers craft a specially built request to the ajax/render/[template] endpoint — using a vulnerable template such as pagenav — and the unsanitized input reaches eval() and executes as PHP code on the server. Security researchers at SSD Secure Disclosure, who discovered the flaw alongside researcher Egidio Romano, confirmed the restrictions can be bypassed using the “phpfuck” encoding technique, and published a working PoC targeting the ajax/render/pagenav route. When a public exploit exists for a pre-auth RCE flaw, unpatched internet-facing servers typically begin seeing scanning and exploitation within hours. vBulletin has a history here: in May 2025, threat actors used public PoCs for two earlier critical flaws, also found by Romano, to actively compromise unpatched forums.
How to check if you’re affected
Affected versions include all vBulletin 5.x builds through 5.7.5 and all 6.x builds through 6.2.1. The fix landed in vBulletin 6.2.2 (released July 1, 2026); security patches were backported as “Patch Level 1” for 6.2.1, 6.2.0, and 6.1.6. The vBulletin technical lead has stated there will be no patch for the 5.x branch — operators running 5.x should treat their forums as vulnerable and upgrade to 6.x immediately. To check your version, log in to the vBulletin admin panel and look at the version string in the header, or check the includes/version.php file on the server.
Sources
- vBulletin fixes critical pre-auth RCE flaw with public exploit — BleepingComputer
- SSD Secure Disclosure advisory and PoC (ssd-disclosure.com)