CVE-2026-61511 allows unauthenticated attackers to execute arbitrary PHP code through vBulletin’s template rendering, a single identifier that puts forum operators and the communities they host squarely in the crosshairs.
CVE-2026-61511 and the versions it affects
The flaw, tracked as CVE-2026-61511, affects vBulletin releases in both the 5.x and 6.x branches up to 5.7.5 and 6.2.1 respectively. vBulletin is a PHP-based proprietary forum platform released in 2000 and used by large online communities, gaming sites, support portals, automotive forums, tech forums, and discussion boards. Although the platform has lost popularity to newer solutions over time, the software still retains a significant installed base — and that base contains versions the vendor has said will not receive fixes for this issue.
The technical cause: runMaths(), eval(), and the “phpfuck” bypass
Independent researcher Egidio Romano reported the vulnerability through the SSD Secure Disclosure program and published a technical write-up. According to Romano, the flaw stems from the runMaths() function, which does not properly sanitize user input before passing it to PHP’s eval() function — code that vBulletin intended to limit to mathematical expressions only. SSD Secure Disclosure’s technical analysis explains that the sanitization restrictions can be bypassed using a technique they call “phpfuck.”
Romano found that an unauthenticated attacker can submit a specially crafted request to the ajax/render/[template] endpoint. When the request is processed by a vulnerable template — the analysis cites the pagenav template as an example — attacker-controlled input can reach eval(), resulting in remote code execution on the server.
Public proof-of-concept, precedent, and exploitation risk
SSD Secure Disclosure also published a proof-of-concept exploit that targets the ajax/render/pagenav route and executes arbitrary system commands on vulnerable servers. The public availability of that PoC lowers the technical barrier to exploitation and, as the reporting notes, typically leads to increased scanning and exploitation attempts against unpatched internet-facing vBulletin servers.
That pattern has recent precedent: in May 2025 threat actors used public PoCs for two critical vBulletin flaws — also discovered by Romano — to target unpatched instances. The combination of a public exploit and a known, reachable endpoint in default installations makes rapid, automated scanning and mass exploitation a credible near-term consequence.
vBulletin’s response: patch timeline, backports, and upgrade advice
CVE-2026-61511 was reported to vBulletin on June 25, 2026. The vendor released v6.2.2 on July 1, 2026, which addressed the flaw. Security patches were backported and released as “Patch Level 1” for earlier 6.x releases, including v6.2.1, v6.2.0, and v6.1.6. Wayne Luke, vBulletin’s technical support lead, posted on the project’s forums that users of older versions should upgrade to a newer release; from that guidance it can be deduced that there will be no updates to address CVE-2026-61511 in the 5.x branch.
What this means for technologists, affected enterprises, and threat actors
- Technologists and security teams: The vendor has released v6.2.2 and backported fixes for several 6.x releases; teams running those versions can apply available patches. The availability of a public PoC and past exploitation of public PoCs heightens the urgency for patching and for watching for increased scanning activity on ajax/render endpoints.
- Affected enterprises and forum operators: Organizations that host forums — including gaming sites, support portals, automotive and tech discussion boards named by the vendor as common vBulletin use cases — should inventory installations, confirm branch and version, and act on the vendor’s upgrade advice. Installations remaining on the 5.x branch should be treated as exposed, since the vendor has indicated those releases will not receive fixes for CVE-2026-61511.
- Threat actors and opportunistic scanners: The SSD Secure Disclosure PoC and the demonstrated “phpfuck” bypass reduce the development work required to exploit vulnerable sites. The May 2025 precedents underscore how quickly public exploits are repurposed against unpatched systems.
Detection context and closing observation
The reporting includes a related detection context: a Picus whitepaper cited that “Security teams log 54% of successful attacks and alert on just 14%.” That gap between successful events and alerts is the setting in which a public PoC for remote code execution becomes particularly dangerous — more attacks can succeed or move through environments unseen. With a vendor fix available as of July 1 and backports for several 6.x releases, the concrete question left by the record is whether operators will apply those updates quickly enough to forestall the increased scanning and exploitation activity that public PoCs tend to trigger.
Original reporting: https://www.bleepingcomputer.com/news/security/vbulletin-fixes-critical-pre-auth-rce-flaw-with-public-exploit/
