A working exploit for a critical vBulletin flaw is now circulating in the open, handing unauthenticated attackers a direct route to running PHP code on forum servers — no account, no login required. The uncomfortable part: the fix has been sitting on vBulletin's patch server for nearly a month, so any administrator who skipped it is now racing a public proof-of-concept.
Tracked as CVE-2026-61511, the pre-authentication remote code execution flaw was reported by a researcher working with SSD Secure Disclosure. The released exploit carries the handle "EgiX" — Egidio Romano, the same researcher behind vBulletin's 2025 template-engine code-execution chain. In other words, the person who burned the platform last year is back.
The bug lives in the runMaths() method inside /includes/vb5/template/runtime.php, which handles the {vb:math} template tag. Before passing an expression to PHP's eval() function, the code runs a regex filter meant to strip anything dangerous — but it still permits digits, parentheses, and math and binary operators, including XOR. That gap is enough. Using "phpfuck"-style encoding, an attacker can smuggle executable PHP through those allowed characters. The exploit reaches it unauthenticated via the ajax/render/pagenav route, feeding a crafted payload through the pagenav[pagenumber] parameter straight into eval().
The stakes are familiar. When Romano's 2025 chain went public, many sites stayed exposed simply because they never upgraded — and exploitation attempts followed within days. Successful attacks can mean data theft, defacement, webshells, or full server compromise.
Affected versions include vBulletin 6.2.1 and earlier, as well as 6.1.6 and earlier. Administrators should immediately upgrade to 6.2.2 or apply Patch Level 1 for 6.2.1, 6.2.0, and 6.1.6; vBulletin Cloud is already patched. Defenders should also comb through logs for suspicious POST requests hitting ajax/render/pagenav with unusually long, arithmetic-heavy pagenav[pagenumber] values — a likely fingerprint of exploitation.