vBulletin Pre-Auth RCE Flaw Exploited: Patch to 6.2.2 Now
Security researchers at SSD Secure Disclosure have published full technical details and an interactive proof-of-concept for CVE-2026-61511, a pre-authentication remote code execution vulnerability in vBulletin's template engine. The flaw, which affects self-hosted vBulletin 6.2.1 and earlier, and 6.1.6 and earlier, allows an unauthenticated attacker to execute arbitrary code on a forum server by reaching PHP's eval() function through a publicly accessible route. vBulletin Cloud customers have already been patched, but administrators running self-hosted deployments must upgrade to 6.2.2 or apply the branch-specific fixes issued at the end of June. The roughly four-week gap between patch availability and public disclosure leaves an open question about whether the bug was actively exploited in the interim, as neither SSD nor vBulletin has confirmed in-the-wild attacks.
The vulnerability lives inside /includes/vb5/template/runtime.php, specifically in the vB5_Template_Runtime::runMaths() method, which processes inline math in vBulletin templates. While the function strips most non-numeric characters, it still permits digits, parentheses, concatenation operators, arithmetic symbols, and bitwise operators such as XOR. That filter is trivially bypassed using a restricted-character technique dubbed "phpfuck," which rebuilds PHP strings and callable function names without any letters. The stock pagenav template then copies a visitor-supplied pagenav[pagenumber] value into a {vb:math} tag, which feeds directly into runMaths() and turns a template-rendering quirk into full unauthenticated code execution via the public ajax/render/pagenav route.
SSD credits an unnamed independent researcher with the original discovery, though the published exploit is signed "EgiX" — the handle of Egidio Romano, who previously disclosed vBulletin's 2025 template-engine code-execution chain. The posted proof-of-concept contains a one-character error that prevents it from running as-is, but the mistake is trivial to correct and does not weaken the underlying attack. As of July 27, 2026, no entry for CVE-2026-61511 existed in CISA's Known Exploited Vulnerabilities catalog, and no official severity score was available since the NVD has scaled back routine CVSS enrichment for new CVEs. Forum operators should verify their deployment version immediately and run a port scanner to confirm that the web frontend is the only attack surface exposed to the internet.
Self-hosted vBulletin administrators who cannot upgrade immediately should disable the ajax/render/pagenav route via web application firewall rules and audit server logs for requests containing phpfuck-style payloads. Given that the attack requires no authentication and no user interaction, unpatched forums running default configurations should be considered actively at risk, especially since public exploit code is now in circulation. For broader hardening, operators can pair their patching effort with a SSL/TLS checker to ensure traffic is properly encrypted, and run a privacy checkup across the full web stack to identify other misconfigurations that could compound the risk.