Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw

A public exploit has been released for a patched pre-authentication remote code execution vulnerability in vBulletin, tracked as CVE-2026-61511. The flaw exists in the template engine's runMaths() method, which allows unauthenticated attackers to execute arbitrary PHP code via crafted requests to the ajax/render/pagenav endpoint. Although patches were released in late June and cloud instances are protected, unpatched self-hosted forums remain at risk. The exploit leverages a 'phpfuck'-style technique to bypass character restrictions and achieve code execution without authentication.

AI-extracted · verify before operational use