Critical vBulletin RCE Flaw Exposes Forum Servers to Unauthenticated Attacks

A critical remote code execution vulnerability, tracked as CVE-2026-61511, has been disclosed in vBulletin, allowing unauthenticated attackers to execute arbitrary PHP code on vulnerable forum servers. The flaw affects vBulletin versions 6.2.1 and earlier, as well as 6.1.6 and earlier. It exists in the vB5_Template_Runtime::runMaths() method within the runtime.php file. Public exploit details have been released, showing how attackers can reach PHP's eval() function without needing any user interaction. This vulnerability poses a significant risk to unpatched forum installations, as it does not require administrative access. The vulnerability was disclosed by SSD Secure Disclosure on July 27, 2026, and a patch has been issued to mitigate the risk. Administrators are urged to apply the patch immediately to protect their systems.

Key Points: • CVE-2026-61511 allows unauthenticated remote code execution on vBulletin servers. • Affected versions include vBulletin 6.2.1 and earlier, and 6.1.6 and earlier. • Public exploit details have been released, increasing the urgency for patching.