Security teams monitoring forum software received fresh cause for concern this week. On July 27, researchers published a working proof-of-concept for a pre-authentication remote code execution flaw in vBulletin. The target? A template engine function that ultimately feeds user-controlled data straight into PHP’s eval().
The vulnerability carries the identifier CVE-2026-61511. It affects self-hosted installations of vBulletin 6.2.1 and earlier versions along with 6.1.6 and earlier. Cloud-hosted instances from the vendor reportedly received the fix already. The Hacker News first detailed how an unauthenticated request reaches the dangerous eval() call through a publicly accessible route.
But here’s the twist. vBulletin shipped patches at the end of June. Version 6.2.2 arrived on July 1. Nearly a month passed before the exploit code surfaced. That gap repeats a pattern seen in prior vBulletin template bugs. And it leaves many administrators exposed longer than necessary.
SSD Secure Disclosure published the technical breakdown. Their analysis credits an unnamed independent researcher. Yet the exploit itself bears the signature of EgiX. That’s the handle of Egidio Romano. He previously disclosed a 2025 template-engine execution chain in the same software. SSD’s advisory walks through the exact mechanics.
The flaw lives in includes/vb5/template/runtime.php. Specifically inside the vB5_Template_Runtime::runMaths() method. This function processes inline math expressions placed inside templates. It strips out most characters. What survives gets passed directly to eval().
Letters are blocked. Digits, parentheses, operators and certain binary functions remain allowed. Attackers can still build strings and function calls. They rely on a restricted-character technique known among researchers as phpfuck. The result reconstructs calls like system() without ever using a single alphabetic character.
Access requires nothing special. vBulletin renders certain templates over the public ajax/render/pagenav endpoint. The default pagenav template takes a pagenav[pagenumber] parameter supplied by any visitor. That value gets inserted into a {vb:math} tag. From there it flows into the vulnerable runMaths() function.
Simple enough chain. One POST request with a carefully crafted payload can trigger operating system command execution. The proof-of-concept returns command output inside the HTTP response body. Field Effect’s security intelligence team noted the same details in their summary published hours after the initial disclosure. No active exploitation had been confirmed as of July 27.
One small error appeared in the published script. A single character typo. It should have been a digit instead of a letter. The mistake prevents the code from running as posted. Yet the fix is trivial. It changes nothing about the underlying weakness.
Local testing by The Hacker News confirmed the behavior. A harmless strlen() test succeeded once the typo was corrected. The allowlist simply removed the invalid character otherwise. Such validation reinforces that the expression-building approach works exactly as described.
Administrators face a familiar recommendation. Apply the patch for your specific branch. Or upgrade straight to 6.2.2. Self-hosted forums reachable from the internet represent the primary risk group now. Cloud customers sit safer. Still, the vendor has not addressed whether attacks occurred during those four weeks between patching and public exploit release.
CVE-2026-61511 lacks an official severity score. The National Vulnerability Database no longer assigns CVSS ratings routinely. No entry appears in CISA’s Known Exploited Vulnerabilities catalog either. SSD reported no evidence of in-the-wild use before disclosure.
This marks at least the third notable pre-authentication code execution issue tied to vBulletin’s template system in recent years. The May 2025 flaws carried CVE-2025-48827 and CVE-2025-48828. Those also targeted the template engine through a different vector. Exploitation attempts followed disclosure quickly. Many sites had never applied the earlier quiet fix.
History repeats here. Vendors issue patches without much fanfare. Researchers later release working exploits. Unpatched internet-facing instances then draw attention. The cycle continues.
Detection becomes important. Security operations centers can watch for POST requests containing routestring=ajax/render/pagenav. Pay special attention when the pagenav[pagenumber] parameter grows unusually long or contains heavy use of operators and parentheses. That pattern comes directly from the public proof-of-concept.
Broader trends in 2026 show similar timing problems across vendors. Microsoft addressed a record number of vulnerabilities in its July Patch Tuesday. Several zero-days received fixes. Public exploits for other flaws such as Certighost in Active Directory Certificate Services appeared shortly after patching. Dataminr’s intelligence brief highlighted how that particular proof-of-concept dropped on July 24, just ten days after the Microsoft update.
GitLab faced its own recent example. Researchers published a full remote code execution proof-of-concept for self-managed version 18.11.3. The company had fixed the issue quietly on June 10 as a bug fix with no CVE assigned. Public discussion on X reflected immediate concern among defenders.
One post from security account @JNitterauer captured the sentiment. “Public exploit dropped for a GitLab RCE on self-managed 18.11.3. Any user who can push runs commands as git. GitLab shipped the fix June 10 as a bug fix, no CVE. Patch now.” The link pointed back to related coverage on The Hacker News.
Similar patterns emerge with SharePoint flaws and Linux kernel issues. Each case underscores the same pressure point. Time between patch availability and exploit publication keeps shrinking. Organizations that delay updates face immediate risk once code appears on GitHub or security research sites.
vBulletin operators should treat this latest disclosure as a call to audit their deployments immediately. Check current versions against the 6.2.2 release. Confirm the security patches from late June were applied. Review web server logs for suspicious requests to the pagenav endpoint. The window for safe inaction closed the moment the proof-of-concept became public.
Researchers continue to find creative ways around input filters. The phpfuck technique demonstrates how limited character sets still permit powerful expression building. PHP’s eval() remains a dangerous primitive when reachable from unauthenticated paths. Forum software, by its very nature, must accept significant user input. That requirement creates persistent attack surface.
Yet the real story extends beyond one bug. It concerns how the industry handles disclosure timing, patch adoption and the lag between vendor fixes and public weaponization. Until that cycle breaks, incidents like this week’s vBulletin exploit will keep appearing on security teams’ dashboards. The code is out there now. The only remaining question is how many forum operators will act before attackers test it against their sites.
WebProNews is an iEntry Publication