A critical vulnerability in vBulletin lets unauthenticated remote attackers execute arbitrary PHP code on a vulnerable forum server, creating a direct path to server compromise. Tracked as CVE-2026-61511, the issue affects vBulletin 6.2.1 and earlier, as well as version 6.1.6 and earlier.
The flaw was disclosed on July 27, 2026, by a researcher working with SSD Secure Disclosure. It resides in the template runtime component, in vB5_Template_Runtime::runMaths() in /includes/vb5/template/runtime.php.
At the center of the vulnerability is an unsafe eval() operation. Before evaluating a supplied expression, the application applies a restrictive regular expression.
Critical vBulletin Pre-Auth RCE Flaw
However, the filter still permits digits, parentheses, periods, arithmetic operators, and binary operators, including XOR. Those permitted primitives are sufficient for PHP expression-obfuscation techniques that can construct callable values and arguments without alphabetic function names.
Attacker-controlled data can therefore reach eval() in a form that supports execution of semi-arbitrary PHP instructions directly. Template editing through the administrative interface can trigger the vulnerable code, but the pre-authentication attack surface is more serious.
An attacker does not need administrator credentials when a publicly reachable template-rendering endpoint can be induced to pass tainted input to a math tag.
SSD Secure Disclosure identified the ajax/render/[template] route as an exploitable path. The pagenav template is a notable example: its pagenav[pagenumber] request parameter is assigned to pagenav.currentpage, which is subsequently consumed inside a {vb:math} expression to calculate a page value.
That sequence sends user-controlled content into runMaths(), where it ultimately reaches eval().
Successful exploitation could enable a threat actor to run operating-system commands through PHP, deploy a web shell, steal forum databases and configuration secrets, alter site content, or pivot into adjacent systems accessible from the server.
The risk is acute because attackers can target internet-facing forums remotely without prior authentication, and exploit code has been published.
Administrators should treat CVE-2026-61511 as an emergency patching event. Organizations should upgrade to vBulletin 6.2.2 where possible or apply the vendor’s security patches for the 6.2.1, 6.2.0, and 6.1.6 branches.
They should also review web and application logs for unusual POST requests targeting ajax/render/pagenav, unexpected pagenav[pagenumber] values, anomalous PHP child processes, newly created files and outbound connections from forum hosts.
Until updates are deployed, restricting public access to template-rendering endpoints through a web application firewall or reverse-proxy rule may reduce exposure, but it does not replace patching.
Incident responders should assume that a suspected successful exploit may constitute full server compromise, rotate credentials stored on the forum host, and review the host for persistence.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
