CVE-2026-61511

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection flaw (CWE-95) in the vB5_Template_Runtime::runMaths() method of the template runtime, where an insufficiently restrictive regex filter fails to block phpfuck-style encoding of PHP payloads using permitted characters. An unauthenticated attacker triggers the flaw by sending crafted input in the pagenav[pagenumber] parameter to the unauthenticated ajax/render template route, causing attacker-controlled PHP code to be evaluated on the server. Successful exploitation yields arbitrary remote code execution in the context of the web application, with network-reachable high impact on confidentiality, integrity, and availability (CVSS 4.0 score 9.3, critical). Every installation running an affected vBulletin 5.x or 6.x release is exposed, since the vulnerable route requires no authentication. Exploitation has not yet been added to CISA KEV, but related coverage indicates a public exploit has been released, and the EPSS score of 70.8% (99th percentile) suggests a high likelihood of exploitation within the next 30 days.

What to do: Upgrade all vBulletin 5.x and 6.x deployments to a vendor-patched release beyond 5.7.5 and 6.2.1 per the official vBulletin security advisory. Where immediate patching is not possible, restrict access to the ajax/render route and deploy WAF rules to flag or block suspicious phpfuck-style encoded input in the pagenav[pagenumber] parameter, and review access logs for exploitation attempts.