A Critical Vulnerability in vBulletin Forum Software Exposes Thousands of Sites to Remote Code Execution Attacks
Thousands of online communities and websites built on the popular vBulletin forum software are at risk of being compromised due to a critical vulnerability discovered by independent security researcher Egidio Romano. The flaw, tracked as CVE-2026-61511, allows unauthenticated attackers to execute arbitrary PHP code through template rendering, putting sensitive data and entire systems at risk.
vBulletin is a widely used proprietary forum platform that has been around since 2000, but its popularity has waned in recent years with the rise of newer solutions. However, it still maintains a significant market share, especially among large online communities, gaming sites, support portals, and discussion boards. Romano’s discovery highlights the importance of regular security updates and patches for legacy software that may no longer be actively developed or maintained.
The vulnerability is caused by the ‘runMaths()’ function in vBulletin, which fails to properly sanitize user input before passing it to PHP’s eval() function. This allows attackers to bypass sanitization restrictions using the “phpfuck” technique, making it possible for them to execute arbitrary system commands on vulnerable servers. Romano demonstrated this exploit by publishing a proof-of-concept (PoC) targeting the ‘ajax/render/pagenav’ route.
The availability of a public PoC for CVE-2026-61511 has already led to increased scanning and exploitation attempts against unpatched vBulletin servers. This is not an isolated incident, as Romano also discovered two other critical vulnerabilities in vBulletin that were exploited by threat actors last year. To mitigate this risk, vBulletin released version 6.2.2 on July 1, which includes a patch for CVE-2026-61511. However, users of older versions are advised to upgrade to the latest release as there will be no further updates for the 5.x branch.
The recent surge in publicly disclosed vulnerabilities and exploits serves as a reminder that legacy software remains a significant threat vector. As seen with vBulletin, outdated platforms can become a breeding ground for attackers seeking to exploit known weaknesses. To stay ahead of these threats, security teams must prioritize regular patching, monitoring, and testing of their systems.
The takeaway for administrators is clear: test every layer of your system before attackers do. Regularly assessing your security posture through breach and attack simulation (BAS) can help identify vulnerabilities and ensure that your SIEM and EDR rules are effective in detecting threats. By staying proactive and vigilant, you can prevent many potential attacks from slipping under the radar.
Source: Bleeping Computer — 2026-07-28