vBulletin Pre

Gbhackers •Divya • July 27, 2026

A critical pre-authentication remote code execution vulnerability in vBulletin, tracked as CVE-2026-61511, could allow unauthenticated attackers to execute arbitrary PHP code on vulnerable forum servers. This issue affects vBulletin versions 6.2.1 and earlier, as well as 6.1.6 and earlier, according to a July 27, 2026, disclosure from SSD Secure Disclosure. If exploited successfully, this vulnerability […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical vBulletin RCE Flaw Exposes Forum Servers to Unauthenticated Attacks A critical remote code execution vulnerability, tracked as CVE-2026-61511, has been disclosed in vBulletin, allowing unauthenticated attackers to execute arbitrary PHP code on vulnerable forum servers. The flaw affects vBulletin versions 6.2.1 and earlier, as well as 6.1.6 and earlier. It exists in the vB5_Template_Runtime::runMaths() method within the runtime.php file. Public exploit details have been released, showing how attackers can reach PHP's eval() function without needing any user interaction. This vulnerability poses a significant risk to unpatched forum installations, as it does not require administrative access. The vulnerability was disclosed by SSD Secure Disclosure on July 27, 2026, and a patch has been issued to mitigate the risk. Administrators are urged to apply the patch immediately to protect their systems. 11 sources 73

Extracted Entities

vBulletin Pre

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)