Public Exploit Emerges for Patched vBulletin Pre-Auth RCE Flaw
A public exploit has been released for a pre-authentication remote code execution vulnerability in vBulletin, nearly four weeks after the vendor patched the issue.
A public exploit has been released for CVE-2026-61511, a critical pre-authentication remote code execution (RCE) vulnerability affecting vBulletin versions 6.2.1 and earlier, and 6.1.6 and earlier. The exploit allows unauthenticated attackers to execute arbitrary PHP code on vulnerable self-hosted forum instances by sending specially crafted requests to the template engine's math rendering function. While vBulletin addressed the flaw with patches in late June and released the fixed version 6.2.2 on July 1, the public disclosure of a working exploit occurred nearly four weeks later, leaving unpatched installations exposed.
The vulnerability resides in the vB5_Template_Runtime::runMaths() method within the /includes/vb5/template/runtime.php file. This function is responsible for processing inline math expressions in templates. It employs a filter that strips characters outside a restricted set before passing the remaining input to PHP's eval() function. Although the filter blocks letters, it permits digits, parentheses, concatenation, and arithmetic operators, enabling attackers to construct PHP code using a technique described as "phpfuck" without using any alphabetic characters.
Exploitation does not require administrative privileges or any user interaction. The vulnerability is reachable through a public route, specifically ajax/render/pagenav. The default pagenav template copies a visitor-supplied pagenav[pagenumber] value into a {vb:math} tag, which then passes it to the vulnerable runMaths() method. This chain effectively transforms a template engine flaw into a pre-authentication RCE vulnerability.
SSD Secure Disclosure, which provided the technical analysis, credits an unnamed independent researcher for discovering the flaw. However, the publicly released exploit code is attributed to "EgiX," the handle of Egidio Romano, known for disclosing a previous vBulletin template-engine code-execution chain in May 2025. At the time of writing, no official CVE.org or National Vulnerability Database record with a severity score was available, as the NVD had recently ceased routinely enriching new CVEs with CVSS scores.
While SSD did not report active exploitation in the wild as of July 27, 2026, and the vulnerability was not listed in CISA's Known Exploited Vulnerabilities catalog, the existence of a public exploit significantly elevates the risk. The published proof-of-concept (PoC) contained a minor typo that prevented it from running unchanged, but this was easily correctable and did not affect the underlying exploitability of the flaw. The period between the vendor's patch release and the exploit's public disclosure remains a critical window where exploitation could have occurred undetected.
Administrators of self-hosted vBulletin installations are strongly urged to apply the relevant patches for their specific branch or upgrade to version 6.2.2 immediately. vBulletin has confirmed that its Cloud-hosted sites have already been secured against this vulnerability. Defenders can monitor POST requests for the routestring=ajax/render/pagenav pattern, particularly those with unusually long or complex pagenav[pagenumber] values, as a potential indicator of malicious activity.
This incident echoes a similar pattern seen with previous vBulletin vulnerabilities, such as the May 2025 template engine RCE chain (CVE-2025-48827 and CVE-2025-48828). In those cases, quiet vendor patches were followed weeks later by public exploits, with many internet-facing forums remaining vulnerable due to delayed patching. The current situation highlights the ongoing challenge of ensuring timely patch deployment across distributed self-hosted environments.
This new report details the specific technical mechanism of the vBulletin RCE flaw, CVE-2026-61511, explaining how the {vb:math} template tag and the ajax/render/template route can be abused. It highlights that the vulnerability exists within the vB5_Template_Runtime::runMaths() method and that inadequate filtering before the eval() function allows for PHP code execution, potentially via "PHPFuck" techniques. The article also emphasizes that exploitation requires no administrator access and provides specific advice on monitoring web server logs for suspicious activity.