Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw

CVE-2026-61511

July 27, 2026 · The Hacker News · Severity: HIGH

Public exploit details were released for a pre-authentication remote code execution vulnerability in vBulletin (CVE-2026-61511). An unauthenticated request can reach PHP's eval() function to execute code on unpatched forum servers without requiring an account or user interaction. vBulletin issued patches for versions 6.2.1, 6.2.0, and 6.1.6 in late June, with version 6.2.2 released July 1. No active exploitation in the wild has been confirmed as of July 27, 2026.

Key Takeaways

Unauthenticated RCE in vBulletin allows attackers to execute code via PHP's eval() without any account or user interaction.
Affected versions: vBulletin 6.2.1 and earlier, 6.1.6 and earlier patches issued late June, fixed version 6.2.2 released July 1.
The public PoC script contains a one-character error that prevents it from running unmodified.