Do Son 
TL;DR: A public proof-of-concept now targets CVE-2026-61511, a vBulletin preauth RCE. The bug lets an unauthenticated attacker run PHP on the server through a math-parsing flaw. vBulletin fixed it in version 6.2.2.
Why This vBulletin Preauth RCE Matters
vBulletin powers many high-traffic forums. This flaw needs no login and no user interaction. Therefore, any exposed 6.x board becomes a direct target. Successful exploitation runs arbitrary PHP as the web server, which can mean full site takeover and access to member data.
How the Attack Works
The problem sits in the runMaths() method inside vBulletin’s template runtime. That method passes weakly filtered input into a PHP eval() call. The filter permits digits, parentheses, and operators, including XOR. As a result, an attacker can encode arbitrary PHP through known character-building tricks.
An unauthenticated request reaches the code through the ajax/render route. A tainted page-number parameter flows into a {vb:math} tag, then into eval(). SSD Secure Disclosure documented the full chain in its public advisory.
Public Disclosure and Exploit Status
Both the vulnerability details and a working proof-of-concept are now public. The advisory ships a complete exploit written by researcher EgiX. So far, researchers have confirmed no in-the-wild exploitation.
Affected Versions
The flaw hits vBulletin 6.2.1 and earlier, plus 6.1.6 and earlier. Both branches share the vulnerable template code.
Patch and Mitigation Steps
Upgrade to vBulletin 6.2.2 right away. For older installs, apply the security patch for 6.2.1, 6.2.0, and 6.1.6. Patching fully closes this vBulletin preauth RCE.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
