A critical remote code execution vulnerability has been disclosed in vBulletin, one of the most widely used forum software platforms, allowing unauthenticated attackers to execute arbitrary PHP code on affected servers without any user interaction or credentials.
Tracked as CVE-2026-61511, the flaw was identified by an independent security researcher working with SSD Secure Disclosure and publicly disclosed on July 27, 2026.
The vulnerability affects vBulletin 6.2.1 and prior, as well as vBulletin 6.1.6 and prior, putting a significant number of active forums at risk.
Critical vBulletin Vulnerability
The vulnerability resides in /includes/vb5/template/runtime.php, specifically within the vB5_Template_Runtime::runMaths() method.
This function processes mathematical expressions used by the {vb:math} template tag but fails to properly sanitize input before passing it to PHP’s eval() function.
The code relies on a regex filter intended to strip anything except digits, parentheses, and math/binary operators.
However, the regex permits the XOR operator (^), which opens the door to “PHP” style exploitation, a technique that constructs arbitrary function calls and strings using only allowed characters through bitwise operations, similar to obfuscation methods seen in JSFuck for JavaScript.
While an attacker with admin panel access could exploit this by crafting a malicious {vb:math} tag in a template, the more dangerous path requires no authentication at all.
By abusing the ajax/render/[template] route, an attacker can render templates that use {vb:math} with attacker-controlled parameters.
The pagenav template is a prime example. It assigns the user-supplied pagenav[pagenumber] parameter directly to a template variable later processed by {vb:math} and ultimately by the vulnerable eval() call without any authentication check.
Proof-of-Concept Exploit
A publicly released PoC exploit (attributed to researcher EgiX) demonstrates full remote shell access.
The script encodes arbitrary PHP function calls (such as system()) using only numeric and XOR operations to bypass the regex filter, then submits the payload via a crafted POST request to ajax/render/pagenav.
This effectively grants attackers an interactive shell on the target server with the web server’s privileges.
Affected Versions
- vBulletin 6.2.1 and earlier
- vBulletin 6.1.6 and earlier
vBulletin has released patches addressing this vulnerability, and administrators should update immediately.
This includes vBulletin 6.2.2, a full version update available via the official vBulletin announcement forum, as well as a security patch for those running 6.2.1, 6.2.0, and 6.1.6 who prefer a targeted fix over a full upgrade.
Organizations unable to patch immediately should consider restricting access to the ajax/render/ endpoint at the web server or WAF level as a temporary mitigation, and monitor logs for anomalous POST requests containing unusual pagenav[pagenumber] values with heavy parentheses or XOR patterns.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
