Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw CVE-2026-61511

A public exploit has been released for a pre-authentication remote code execution vulnerability in vBulletin, tracked as CVE-2026-61511. The flaw resides in the vB5_Template_Runtime::runMaths() method within /includes/vb5/template/runtime.php, where user-supplied input is passed directly to PHP’s eval() function after a character filter. The filter blocks letters but allows digits, operators, and concatenation, enabling an attacker to reconstruct PHP strings and call system functions using a technique called “phpfuck.” The attack vector involves sending a crafted POST request to the public route ajax/render/pagenav with a malicious pagenav[pagenumber] value. No authentication or user interaction is required.

vBulletin issued patches for versions 6.2.1, 6.2.0, and 6.1.6 in late June 2026, and released version 6.2.2 on July 1, 2026. The exploit was published on July 27, 2026, nearly four weeks after the fix. The exploit code contains a trivial one-character typo that prevents it from running unchanged, but the underlying vulnerability remains exploitable. vBulletin Cloud sites have been patched, leaving self-hosted, internet-facing forums that have not updated as the primary risk. No active exploitation has been confirmed, and CVE-2026-61511 is not listed in CISA’s Known Exploited Vulnerabilities catalog. Defenders should monitor for POST requests with routestring=ajax/render/pagenav and unusually long or operator-heavy pagenav[pagenumber] values.

This is not the first time vBulletin’s template engine has been exploited. In May 2025, CVE-2025-48827 and CVE-2025-48828 were abused through a different path, with exploitation attempts occurring shortly after disclosure. The pattern of a quiet patch followed by a public exploit weeks later continues to put unpatched forums at risk.