vBulletin Critical RCE Flaw Has Public Exploit Available

A critical vBulletin vulnerability can let unauthenticated attackers execute arbitrary PHP code on vulnerable forum servers. The flaw, tracked as CVE-2026-61511, affects several releases in the 5.x and 6.x branches and now has a public proof-of-concept exploit.

Administrators should apply the available security updates immediately. Internet-facing forums are especially exposed because attackers can target the flaw without first logging in.

CVE-2026-61511 affects vBulletin 5.x and 6.x

The vBulletin critical RCE flaw affects versions up to vBulletin 5.7.5 and vBulletin 6.2.1. vBulletin is a long-running PHP forum platform used by online communities, support sites, gaming forums and discussion boards.

Although newer forum tools have taken market share, many organisations still operate vBulletin servers. As a result, the vulnerability could affect a substantial number of public-facing sites.

Security researcher Egidio Romano discovered and reported the issue through the SSD Secure Disclosure programme.

Template rendering bug enables remote code execution

The flaw stems from the runMaths() function, which does not safely handle user-controlled input before sending it to PHP’s eval() function.

An attacker can send a specially crafted request to a vulnerable template-rendering endpoint. Certain templates then pass that input through the affected function, allowing arbitrary PHP code execution on the server.

SSD Secure Disclosure said the input restrictions can be bypassed using a technique known as “phpfuck.” Researchers also released a proof-of-concept exploit that demonstrates command execution on affected systems.

Public exploit raises the risk for unpatched forums

Public exploit code often leads to faster scanning and exploitation attempts. Attackers can use it to identify exposed, unpatched vBulletin servers and attempt to take control of them remotely.

The risk is not theoretical. In May 2025, threat actors used public exploits for two other critical vBulletin vulnerabilities, also discovered by Romano, to target unpatched installations.

Administrators should therefore treat CVE-2026-61511 as an urgent patching priority.

vBulletin released patches for supported 6.x versions

vBulletin received the vulnerability report on 25 June 2026 and released vBulletin 6.2.2 on 1 July with a fix.

The company also backported the update as Patch Level 1 for vBulletin 6.2.1, 6.2.0 and 6.1.6.

However, users on the older 5.x branch may need to upgrade to a newer release. vBulletin’s technical support team has advised customers running older versions to move to a supported version, indicating that fixes may not be issued for the 5.x line.