vBulletin patches critical unauthenticated RCE flaw with public PoC
Summary
CVE-2026-61511 lets unauthenticated attackers execute PHP code on vulnerable vBulletin 5.x and 6.x servers via template rendering. A public PoC is available; v6.2.2 and select backports patch the flaw.
Key points
- The flaw affects vBulletin 5.x and 6.x releases, including versions up to 5.7.5 and 6.2.1.
- Improper input sanitization in runMaths() allows attacker-controlled input to reach PHP’s eval() function.
- Unauthenticated attackers can exploit the ajax/render/[template] endpoint through a vulnerable template such as pagenav.
- Researchers published a PoC targeting the ajax/render/pagenav route and executing system commands.
- vBulletin fixed the issue in v6.2.2 and backported patches to select 6.x releases, including 6.2.1, 6.2.0 and 6.1.6.
- Users of older 5.x versions are advised to upgrade; the article says no 5.x fix is indicated.
Article Details
- Vulnerability Types
- Improper input sanitization enabling unauthenticated PHP code execution and remote code execution
- Severity
- Critical
- Affected Versions
- vBulletin 5.x up to 5.7.5
- vBulletin 6.x up to 6.2.1
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Upgrade older versions to a newer release; patches are available in vBulletin 6.2.2 and selected backported releases.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe published PoC executes arbitrary system commands after attacker-controlled input reaches PHP's eval() function.T1190 · Exploit Public-Facing ApplicationThe flaw can be exploited by unauthenticated attackers through a crafted request to vBulletin's ajax/render/[template] endpoint on vulnerable servers.