Critical Remote Code Execution Flaw in vBulletin Exposes Forums to Unauthenticated Attacks
A severe remote code execution (RCE) vulnerability in vBulletin, a widely used forum software, has been disclosed, allowing unauthenticated attackers to execute arbitrary PHP code on vulnerable servers without requiring credentials or user interaction. The flaw, tracked as CVE-2026-61511, was identified by an independent security researcher in collaboration with SSD Secure Disclosure and publicly revealed on July 27, 2026.
The vulnerability affects vBulletin 6.2.1 and earlier, as well as 6.1.6 and earlier, exposing a large number of active forums to potential exploitation. The issue lies in the /includes/vb5/template/runtime.php file, specifically within the vB5_Template_Runtime::runMaths() method, which processes mathematical expressions used by the {vb:math} template tag. The function fails to properly sanitize input before passing it to PHP’s eval() function, relying on a flawed regex filter that permits the XOR operator (^) a loophole enabling "PHP-style exploitation" through bitwise operations.
While the flaw could be exploited by attackers with admin access via malicious {vb:math} tags, the more critical attack vector requires no authentication. By abusing the ajax/render/[template] route, attackers can render templates containing {vb:math} with attacker-controlled parameters. The pagenav template, for example, directly assigns the user-supplied pagenav[pagenumber] parameter to a variable processed by the vulnerable eval() call.
A proof-of-concept (PoC) exploit, released by researcher EgiX, demonstrates how attackers can encode arbitrary PHP function calls (such as system()) using only numeric and XOR operations to bypass the regex filter. The payload is delivered via a crafted POST request to ajax/render/pagenav, granting attackers an interactive shell with the web server’s privileges.
Affected versions include:
- vBulletin 6.2.1 and earlier
- vBulletin 6.1.6 and earlier
vBulletin has released patches, including version 6.2.2 and a targeted security patch for 6.2.1, 6.2.0, and 6.1.6. Organizations unable to patch immediately are advised to restrict access to the ajax/render/ endpoint at the web server or WAF level and monitor logs for suspicious POST requests containing unusual pagenav[pagenumber] values with excessive parentheses or XOR patterns.
Source: https://cyberpress.org/critical-vbulletin-vulnerability/
vBulletin TPRM report: https://www.rankiteo.com/company/vbulletin-solutions-inc.
"id": "vbu1785147839",
"linkid": "vbulletin-solutions-inc.",
"type": "Vulnerability",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Organizations using vBulletin '
'6.2.1 and earlier, or 6.1.6 and '
'earlier',
'industry': 'Internet Forum Software',
'name': 'vBulletin',
'type': 'Software'}],
'attack_vector': 'Unauthenticated exploitation via crafted POST request to '
'`ajax/render/pagenav`',
'date_publicly_disclosed': '2026-07-27',
'description': 'A severe remote code execution (RCE) vulnerability in '
'vBulletin, a widely used forum software, has been disclosed, '
'allowing unauthenticated attackers to execute arbitrary PHP '
'code on vulnerable servers without requiring credentials or '
'user interaction. The flaw, tracked as CVE-2026-61511, was '
'identified by an independent security researcher in '
'collaboration with SSD Secure Disclosure and publicly '
'revealed on July 27, 2026. The vulnerability affects '
'vBulletin 6.2.1 and earlier, as well as 6.1.6 and earlier, '
'exposing a large number of active forums to potential '
'exploitation. The issue lies in the '
'`/includes/vb5/template/runtime.php` file, specifically '
'within the `vB5_Template_Runtime::runMaths()` method, which '
'processes mathematical expressions used by the `{vb:math}` '
'template tag. The function fails to properly sanitize input '
'before passing it to PHP’s `eval()` function, relying on a '
'flawed regex filter that permits the XOR operator (^) as a '
'loophole enabling PHP-style exploitation through bitwise '
'operations. A proof-of-concept (PoC) exploit demonstrates how '
'attackers can encode arbitrary PHP function calls (such as '
'`system()`) using only numeric and XOR operations to bypass '
'the regex filter.',
'impact': {'brand_reputation_impact': 'Potential reputational damage for '
'affected organizations',
'operational_impact': 'Potential unauthorized code execution on '
'servers',
'systems_affected': 'vBulletin forums running vulnerable versions'},
'post_incident_analysis': {'corrective_actions': 'Patch vulnerable versions, '
'restrict access to '
'vulnerable endpoints, and '
'implement enhanced '
'monitoring.',
'root_causes': 'Flawed input sanitization in '
'`vB5_Template_Runtime::runMaths()` '
'method leading to arbitrary PHP '
'code execution via `eval()`'},
'recommendations': 'Apply patches immediately, restrict access to vulnerable '
'endpoints, and monitor for exploitation attempts.',
'references': [{'source': 'SSD Secure Disclosure'},
{'source': 'Researcher EgiX (PoC exploit)'}],
'response': {'containment_measures': 'Restrict access to the `ajax/render/` '
'endpoint at the web server or WAF level',
'enhanced_monitoring': 'Monitor logs for suspicious POST '
'requests containing unusual '
'`pagenav[pagenumber]` values with '
'excessive parentheses or XOR patterns',
'remediation_measures': 'Apply patches (vBulletin 6.2.2 or '
'security patch for 6.2.1, 6.2.0, and '
'6.1.6)'},
'title': 'Critical Remote Code Execution Flaw in vBulletin Exposes Forums to '
'Unauthenticated Attacks',
'type': 'Remote Code Execution (RCE)',
'vulnerability_exploited': 'CVE-2026-61511'}