Vulnerabilities

vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum.

CVE-2025-48827 is an access-control flaw in vBulletin's API layer: when the software runs on PHP 8.1 or later, methods marked as 'protected' in API controllers can be invoked by completely unauthenticated users. It is triggered simply by requesting a protected method through the front controller, e.g. /api.php?method=<protectedMethod>, with no credentials or user interaction required. An attacker gains the ability to call internal controller methods that were never intended to be exposed externally, and publicly documented attacks chain this with a companion vBulletin flaw to achieve pre-authentication remote code execution. Anyone running vBulletin 5.0.0 through 5.7.5 or 6.0.0 through 6.0.3 on PHP 8.1 or later is affected, making forum operators the primary exposure group. The bug was exploited in the wild in May 2025, a public exploit write-up is available, and EPSS assigns a 75.8% probability of exploitation within 30 days (99th percentile), although it is not yet in CISA's KEV catalog.

Do: Upgrade all vBulletin 5.7.x and 6.0.x installations to the vendor's patched releases (issued May 2025); as an interim mitigation, restrict or block unauthenticated access to /api.php. Verify the PHP version in use, since the flaw only manifests on PHP 8.1 or later, and review web-server logs for requests that invoke protected controller methods via /api.php.

A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter.

The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce validation on the 'bulletinwp_update_bulletin_status', 'bulletinwp_update_bulletin', 'bulletinwp_update_settings', 'bulletinwp_update_status', 'bulletinwp_export_bulletins', and 'bulletinwp_import_bulletins' functions in versions up to, and including, 3.7.0. This makes it possible for unauthenticated attackers to modify the plugin's settings, modify bulletins, create new bulletins, and more, via a forged request granted they can trick a site's user into performing an action such as clicking on a link.

vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is the preferred CVE ID to track this vulnerability.

The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options.

CVE-2020-17496 is an unauthenticated remote command execution flaw in vBulletin 5 (CWE-74, improper command neutralization) that exists because the vendor's fix for the earlier CVE-2019-16759 was incomplete. An attacker triggers it by sending a request to the ajax/render/widget_tabbedcontainer_tab_panel route with crafted subWidgets data, which the application processes without adequate sanitization. Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary commands on the web server with the privileges of the web application, enabling site compromise, data theft, or deployment of webshells or botnet malware. All vBulletin deployments running versions 5.5.4 through 5.6.2 are affected. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), public proof-of-concept exploits and a detailed public analysis exist, and EPSS estimates an 87.7% probability of exploitation within 30 days; ransomware association is listed as unknown.

Do: Upgrade vBulletin to a release newer than 5.6.2 following the vendor's update instructions, as required by CISA's KEV listing. As an interim mitigation, restrict or block access to the ajax/render route (e.g., via WAF rules). Given confirmed in-the-wild exploitation, review web server logs for requests to ajax/render/widget_tabbedcontainer_tab_panel with crafted subWidgets parameters and check for signs of compromise such as webshells or unexpected processes running as the web server user.

vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.

vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.

vBulletin through 5.5.4 mishandles custom avatars.

CVE-2019-16759 is a critical (CVSS 9.8) unauthenticated remote code execution flaw in vBulletin 5.x through 5.5.4 (CWE-94, code injection) in the PHP widget rendering component. An attacker triggers it by sending a crafted request to the 'ajax/render/widget_php' routestring with a malicious PHP payload in the widgetConfig[code] parameter, requiring no credentials or user interaction. Successful exploitation yields remote command execution on the web server as the web application user, enabling full compromise of the forum, theft or modification of its user database, and a foothold for further network access. Any site running vBulletin 5.x through 5.5.4 is affected, and exploitation is confirmed in the wild: the flaw was attacked as a zero-day after public exploits appeared, with headline-reported compromises including the Comodo Forums breach affecting about 245,000 users and the ZoneAlarm forum hack, and botnets observed exploiting the flaw. It is listed in CISA KEV (added 2021-11-03) with a 99.7% EPSS score, indicating near-certain near-term exploitation probability.

Do: Upgrade vBulletin to a release newer than 5.5.4 (the patched 5.5.x version per vendor instructions), as required by the CISA KEV action. As an interim mitigation, block or filter requests to the 'ajax/render/widget_php' routestring (or strip the widgetConfig[code] parameter) at the web server or WAF. Because exploitation requires no authentication and public PoC exploits are widely available, assume compromise and check logs for requests to ajax/render/widget_php containing widgetConfig[code], and investigate any forum for signs of data theft or web shell implantation.

vBulletin 5.4.3 has an Open Redirect.

vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.

In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates.

In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url function, aka VBV-17037.

The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4.2.3 before Patch Level 2, 5.x before 5.2.0 Patch Level 3, 5.2.1 before Patch Level 1, and 5.2.2 before Patch Level 1 allows remote attackers to conduct SSRF attacks via a crafted URL that results in a Redirection HTTP status code.

SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute arbitrary SQL commands via the postids parameter to forumrunner/request.php, as exploited in the wild in July 2016.