CVE-2025-48827

CVE-2025-48827 is an access-control flaw in vBulletin's API layer: when the software runs on PHP 8.1 or later, methods marked as 'protected' in API controllers can be invoked by completely unauthenticated users. It is triggered simply by requesting a protected method through the front controller, e.g. /api.php?method=<protectedMethod>, with no credentials or user interaction required. An attacker gains the ability to call internal controller methods that were never intended to be exposed externally, and publicly documented attacks chain this with a companion vBulletin flaw to achieve pre-authentication remote code execution. Anyone running vBulletin 5.0.0 through 5.7.5 or 6.0.0 through 6.0.3 on PHP 8.1 or later is affected, making forum operators the primary exposure group. The bug was exploited in the wild in May 2025, a public exploit write-up is available, and EPSS assigns a 75.8% probability of exploitation within 30 days (99th percentile), although it is not yet in CISA's KEV catalog.

What to do: Upgrade all vBulletin 5.7.x and 6.0.x installations to the vendor's patched releases (issued May 2025); as an interim mitigation, restrict or block unauthenticated access to /api.php. Verify the PHP version in use, since the flaw only manifests on PHP 8.1 or later, and review web-server logs for requests that invoke protected controller methods via /api.php.