A critical flaw in vBulletin, tracked as CVE-2026-61511, lets unauthenticated attackers execute arbitrary PHP code through template rendering and can lead to remote code execution on vulnerable servers. The issue affects vBulletin 5.x and 6.x releases, has a public proof-of-concept, and was patched in v6.2.2 with backports to select 6.x versions, while older 5.x users are advised to upgrade. #vBulletin #CVE-2026-61511 #EgidioRomano #SSDSecureDisclosure
Keypoints
- CVE-2026-61511 allows unauthenticated PHP code execution in vBulletin.
- The flaw affects vBulletin versions up to 5.7.5 and 6.2.1.
- The vulnerability comes from improper sanitization in the runMaths() function.
- Attackers can exploit the ajax/render/[template] endpoint using crafted requests.
- A public PoC and patch availability increase urgency for internet-facing vBulletin servers.