Public exploit details released on July 27 show how an unauthenticated request can reach PHP’s eval() function inside vBulletin and execute code on an unpatched forum server. The attack requires no account, administrative access, or interaction from another user.
SSD Secure Disclosure lists vBulletin 6.2.1 and earlier, and 6.1.6 and earlier, as affected, but does not give a lower version boundary. vBulletin issued security patches for 6.2.1, 6.2.0, and 6.1.6 at the end of June and released the fixed version 6.2.2 on July 1, nearly four weeks before the exploit went public
Administrators running self-hosted installations should apply the patch for their branch or upgrade to 6.2.2. vBulletin says its Cloud sites have already been patched against the flaw.
SSD did not report active exploitation. As of July 27, 2026, no source had confirmed in-the-wild attacks, and CVE-2026-61511 was not listed in CISA’s Known Exploited Vulnerabilities catalog. The company published an interactive proof-of-concept, but the script as posted contains a one-character error, a letter where a digit belongs, that stops it running unchanged.
The mistake is trivial to correct and does not affect the underlying vulnerability. One thing the public record does not settle is whether the flaw was used in the roughly four weeks between the late-June patch and the July 27 disclosure; neither SSD’s advisory nor vBulletin’s notices address that window.
SSD’s technical analysis identifies it as CVE-2026-61511, an unauthenticated remote code execution flaw in vBulletin’s template engine. No CVE.org or National Vulnerability Database record, and so no official severity score, was available at the time of writing; the NVD stopped routinely enriching new CVEs with CVSS scores earlier this year.
SSD credits an unnamed independent researcher, though the published exploit is signed “EgiX,” the handle of Egidio Romano, who disclosed vBulletin’s 2025 template-engine code-execution chain.
The vulnerable code sits in /includes/vb5/template/runtime.php, inside the vB5_Template_Runtime::runMaths() method, which handles inline math in templates. The function strips characters outside a restricted set, then passes what remains directly to eval(). The filter blocks letters but permits digits, parentheses, concatenation, arithmetic operators, and binary operators such as XOR, enough to reconstruct PHP strings and callable function names without any letters, using a restricted-character technique the advisory calls “phpfuck.”
Reaching it does not require the admin panel. vBulletin renders templates over a public route, ajax/render/pagenav, and the stock pagenav template copies a visitor-supplied pagenav[pagenumber] value into a {vb:math} tag, which passes it to runMaths().
That chain is what turns a template bug into pre-authentication remote code execution; SSD’s PoC uses it to rebuild PHP’s system function and run an operating-system command, returning the output in the HTTP response.
The Hacker News reproduced the disclosed filtering and evaluation logic locally to check the reported error. With the typo corrected, a harmless strlen() test payload executed; without it, the allowlist stripped the stray letter and left syntactically invalid PHP. The test confirmed the expression-building flaw, not a complete attack against a live vBulletin server.
The exploit’s own banner calls the issue a zero-day, but the vendor’s patches and the 6.2.2 release preceded public disclosure by nearly four weeks. The exploit code is new; the flaw it targets was already fixed. With Cloud reportedly patched and the self-hosted fixes nearly a month old, the live risk is concentrated in self-hosted, internet-facing forums that have not updated, a more specific population than a bare “vBulletin RCE” implies.
Defenders can review POST requests carrying routestring=ajax/render/pagenav with unusually long or operator-heavy pagenav[pagenumber] values, a pattern derived from the public PoC rather than vendor detection guidance.
This is the same corner of vBulletin that has produced pre-authentication code execution before. The May 2025 chain, CVE-2025-48827 and CVE-2025-48828, abused the template engine through a different path and drew exploitation attempts within days of disclosure, after the vendor had quietly patched it months earlier and many forums never applied the fix.
Each round has run the same way. A quiet fix goes out first, a working exploit surfaces weeks later, and by then many internet-facing forums are still running the vulnerable builds.
