vBulletin fixes critical pre-auth RCE flaw with public exploit

CVE-2026-61511

July 28, 2026 · BleepingComputer · Severity: CRITICAL

CVE-2026-61511 is a critical pre-authentication remote code execution vulnerability in vBulletin forum software affecting versions up to 5.7.5 and 6.2.1. The flaw resides in the runMaths() function, which fails to sanitize user input before passing it to PHP's eval(). Unauthenticated attackers can exploit this by sending a crafted request to the ajax/render/[template] endpoint. Researcher Egidio Romano discovered and reported the flaw through SSD Secure Disclosure, publishing a technical analysis and PoC using 'phpfuck' to bypass sanitization. vBulletin 6.2.2 was released July 1, 2026, with patches backported for versions 6.2.1, 6.2.0, and 6.1.6. The 5.x branch will not receive updates.

Key Takeaways

Pre-auth RCE in vBulletin — CVE-2026-61511 allows unauthenticated attackers to execute arbitrary PHP code via unsanitized input in the runMaths() eval() call.
Exploit via ajax/render endpoint — Attackers send crafted requests to ajax/render/[template] using vulnerable templates like 'pagenav'.
vBulletin 6.2.2 patched July 1 — Backported patches available for 6.2.1, 6.2.0, and 6.1.6; 5.x branch unsupported.