Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw

A public exploit for a remote code execution (RCE) vulnerability in vBulletin has been released, targeting versions 6.2.1 and earlier, and 6.1.6 and earlier. The vulnerability allows an attacker to execute code on an unpatched vBulletin server without needing an account, administrative access, or user interaction. The exploit was released on July 27th, but patches were issued nearly four weeks earlier by vBulletin. SSD Secure Disclosure identified the vulnerability as CVE-2026-61511, a flaw within vBulletin's template engine, specifically in the `runMaths()` method of the `vB5_Template_Runtime` class. The vulnerability lies in how the template engine handles inline math, stripping characters outside a restricted set before passing the remaining characters directly to PHP's `eval()` function.

The exploit leverages a technique called "phpfuck" – using a restricted set of characters to reconstruct PHP strings and callable function names without letters. The exploit requires a POST request to the `ajax/render/pagenav` route, passing a `pagenav[pagenumber]` value. The vulnerability is not actively being exploited at this time, but the risk remains for self-hosted, internet-facing vBulletin forums that have not been updated. SSD credits the discovery to an unnamed independent researcher, identified as "EgiX" (Egidio Romano).

Similar to a previous vulnerability in May 2025 (CVE-2025-48827 and CVE-2025-48828), a patch was released, but many forums failed to apply it. The exploit surfaced weeks later, highlighting a common pattern: a quiet patch is released, followed by a working exploit appearing weeks later, leaving many internet-facing forums vulnerable. Defenders should monitor POST requests carrying `routestring=ajax/render/pagenav` with unusually long or operator-heavy `pagenav[pagenumber]` values.