Security researchers have confirmed the release of a public exploit targeting a patched remote code execution (RCE) vulnerability affecting vBulletin forum software. This critical flaw, identified as CVE-2026-61511, allows unauthenticated attackers to execute arbitrary PHP code on vulnerable servers. The availability of this exploit significantly elevates the risk for organizations using older versions of vBulletin and underscores the importance of promptly applying security patches.
The vulnerability stems from an issue within the template engine, specifically in the file /includes/vb5/template/runtime.php, within the vB5_Template_Runtime::runMaths() method. Researchers have found that a regular expression intended to remove unsafe characters fails to adequately sanitize user input. This flawed sanitization process retains digits, parentheses, arithmetic operators, binary operators, concatenation characters, and the XOR operator, ultimately allowing malicious code to be injected and executed via PHP’s eval() function.
The vulnerability affects vBulletin versions 6.2.1 and earlier, as well as 6.1.6 and earlier. vBulletin released patches at the end of June 2026, with version 6.2.2 becoming available on July 1, 2026. Despite these updates, the recent release of a functional exploit highlights the potential for widespread exploitation if forums remain unpatched. Public exploit details were released on July 27, demonstrating how an unauthenticated request can reach PHP’s template engine and execute code.
The attack vector involves crafting a malicious request that leverages the vulnerable {vb:math} template tag. While a one-character error prevents the provided proof-of-concept script from running unchanged, the underlying vulnerability remains exploitable. Attackers can exploit this flaw to gain control of the forum server and potentially compromise sensitive data or perform other malicious actions. The ability for an attacker to execute code without authentication dramatically increases the severity of this vulnerability.
Organizations utilizing vBulletin are strongly urged to immediately update their installations to the latest available version (6.2.2 or later) to mitigate the risk of exploitation. Security teams should also conduct thorough audits of their web application firewalls and intrusion detection systems to identify and block any suspicious activity related to this vulnerability. Vulnerable forums present a significant attack surface and require immediate remediation.
Sources:
