Public exploit details, released on July 27, reveal how an unauthenticated request can leverage PHP's `eval()` function within **vBulletin** to execute code on unpatched forum servers. This attack requires no account, administrative access, or interaction from another user. **SSD Secure Disclosure** has identified **vBulletin** versions 6.2.1 and earlier, and 6.1.6 and earlier, as affected. **vBulletin** issued security patches for 6.2.1, 6.2.0, and 6.1.6 at the end of June, followed by the release of fixed version 6.2.2 on July 1, nearly four weeks prior to the exploit's public disclosure. ### Immediate Action for Administrators Administrators managing self-hosted **vBulletin** installations are strongly advised to apply the relevant patch for their branch or upgrade to version 6.2.2. **vBulletin** has confirmed that its Cloud sites have already been patched against this flaw. ### No Active Exploitation Reported, Yet As of July 27, **SSD** has not reported active exploitation of **CVE-2026-61511** in the wild. The vulnerability was also not listed in **CISA's Known Exploited Vulnerabilities** catalog at the time of writing. While an interactive proof-of-concept (PoC) was published, it contained a minor, easily correctable error that prevented it from running without modification. The public record does not clarify whether the flaw was exploited during the approximately four-week window between the late-June patch release and the July 27 disclosure. ### Technical Deep Dive into CVE-2026-61511 **SSD's** technical analysis identifies **CVE-2026-61511** as an unauthenticated remote code execution flaw residing in **vBulletin's** template engine. At the time of writing, no official **CVE.org** or **National Vulnerability Database (NVD)** record was available, meaning no official severity score has been assigned. **SSD** credits an unnamed independent researcher for the discovery, though the published exploit is signed by "**EgiX**," the handle of **Egidio Romano**, known for disclosing a previous **vBulletin** template-engine code-execution chain in 2025. The vulnerable code is located in `/includes/vb5/template/runtime.php`, specifically within the `vB5_Template_Runtime::runMaths()` method, which handles inline mathematics in templates. The function strips characters outside a restricted set before directly passing the remaining input to `eval()`. The filter blocks letters but permits digits, parentheses, concatenation, arithmetic operators, and binary operators like XOR. This allows for the reconstruction of PHP strings and callable function names without using letters, a technique the advisory dubs "phpfuck." ### Exploit Chain and Impact Reaching this vulnerable code does not require administrator panel access. **vBulletin** renders templates over a public route, `ajax/render/pagenav`. The default `pagenav` template copies a visitor-supplied `pagenav[pagenumber]` value into a `{vb:math}` tag, which then passes it to `runMaths()`. This chain transforms a template bug into pre-authentication remote code execution. **SSD's** PoC demonstrates this by rebuilding PHP's `system` function to execute an operating-system command and return the output within the HTTP response. Local reproduction of the disclosed filtering and evaluation logic confirmed the expression-building flaw. With the minor typo corrected, a harmless `strlen()` test payload executed successfully, validating the underlying vulnerability. ### Not a Zero-Day, But Still a Threat While the exploit's banner labels the issue as a zero-day, the vendor's patches and the 6.2.2 release preceded public disclosure by nearly four weeks. The exploit code itself is new, but the vulnerability it targets was already addressed. Given that Cloud instances are reportedly patched and self-hosted fixes have been available for almost a month, the immediate risk is concentrated among self-hosted, internet-facing forums that have not yet updated. Defenders can look for POST requests containing `routestring=ajax/render/pagenav` with unusually long or operator-heavy `pagenav[pagenumber]` values. This detection pattern is derived from the public PoC rather than vendor guidance. This is not the first time this particular area of **vBulletin** has yielded pre-authentication code execution. The May 2025 chain, comprising **CVE-2025-48827** and **CVE-2025-48828**, exploited the template engine through a different path. Those vulnerabilities also saw exploitation attempts within days of disclosure, despite being quietly patched months earlier, leaving many forums vulnerable. The pattern remains consistent: a quiet fix is released, followed weeks later by a working exploit, often finding numerous internet-facing forums still running outdated, vulnerable builds.