Vulnerable vBulletin Forums Exposed to Critical Remote Code Execution Flaw
A critical security vulnerability has been discovered in the popular vBulletin forum software, allowing unauthenticated attackers to execute arbitrary PHP code. The issue, tracked as CVE-2026-61511, affects vBulletin versions 5.x and 6.x up to 5.7.5 and 6.2.1 respectively, leaving thousands of online communities vulnerable to potential attacks.
vBulletin is a widely used proprietary forum platform that has been around since 2000. Despite losing popularity in recent years to newer solutions, it still retains a significant market share among large online communities, gaming sites, support portals, and discussion boards. The software’s reliance on PHP-based architecture makes it susceptible to vulnerabilities like the one discovered by independent security researcher Egidio Romano.
According to Romano’s research, the flaw is caused by the ‘runMaths()’ function not properly sanitizing user input before passing it to PHP’s eval() function. This allows attackers to bypass sanitization restrictions using a technique known as “phpfuck”, ultimately resulting in remote code execution. The availability of a public proof-of-concept (PoC) exploit further exacerbates the situation, making it easier for attackers to scan and exploit vulnerable servers.
The vulnerability was reported to vBulletin on June 25, 2026, and version 6.2.2 was released just six days later, addressing the issue. Security patches were also backported to earlier releases, including versions 6.2.1, 6.2.0, and 5.7.5. However, it appears that there will be no updates for vBulletin 5.x, leaving users of older versions vulnerable.
For those using vBulletin, this serves as a stark reminder to prioritize security patching and keep software up-to-date. With the existence of public exploits and proof-of-concept attacks, the risk of being targeted by attackers is higher than ever. It’s essential for administrators to test every layer of their environment before attackers do.
In light of this vulnerability, it’s crucial that vBulletin users take immediate action to protect themselves. If you’re using an affected version, update your software to the latest release as soon as possible. For those who cannot upgrade immediately, ensure that all security patches are applied and keep a close eye on system logs for any suspicious activity. Remember, patching is not a one-time task – it’s an ongoing process that requires regular monitoring and maintenance.
Test every layer before attackers do
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Get the whitepaper
Source: Bleeping Computer — 2026-07-28