Critical vBulletin RCE Flaw CVE-2026-61511 Has Public Exploit

A critical pre-authentication remote code execution vulnerability in vBulletin forum software now has a public proof-of-concept exploit, putting thousands of forum installations at immediate risk.

Tracked as CVE-2026-61511, the flaw carries a CVSS severity score of 9.8 (Critical) under version 3.1 and 9.3 under CVSS 4.0. The vulnerability affects vBulletin 5.x through 5.7.5 and all 6.x versions from 6.0.0 to 6.2.1, encompassing thousands of forum installations worldwide.

Technical Details

The vulnerability resides in the vB5_Template_Runtime::runMaths() method within /includes/vb5/template/runtime.php, according to technical analysis published by SSD Secure Disclosure. This method processes the {vb:math} template tag used by vBulletin's templating engine.

While the application attempts to filter unsafe characters before evaluation, it permits digits, parentheses, and operators including XOR. These characters are then passed directly to PHP's eval() function. Attackers can reach this code path without authentication via the ajax/render/[template] route by manipulating the pagenav[pagenumber] parameter in the pagenav template.

The public proof-of-concept exploit uses phpfuck-style encoding techniques to construct arbitrary PHP payloads from this restricted character set, bypassing the application's filtering logic entirely.

Patch Status

vBulletin has released version 6.2.2 and security patches for versions 6.2.1, 6.2.0, and 6.1.6 to address the issue. However, installations running the vBulletin 5.x branch face a more difficult situation: no patch is available for the 5.x series, and administrators must upgrade to version 6.2.2 to remediate the vulnerability.

Why This Matters

Because the flaw requires no authentication and no user interaction, any internet-facing vBulletin installation on affected versions represents an immediate target. Successful exploitation grants attackers full control over the web application context, enabling data theft, site defacement, or complete server compromise.

The availability of a working public exploit significantly increases the likelihood of widespread exploitation. Security researchers typically warn that the window between PoC release and active wild exploitation can be measured in hours for vulnerabilities of this severity.

Administrators running vBulletin should prioritize immediate patching or upgrading to version 6.2.2. Those unable to patch immediately should consider taking affected installations offline or implementing web application firewall rules to block exploitation attempts via the ajax/render endpoint.