Two flaws in vBulletin forum software are under attack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-48827 +1 in the same advisory: …48828 | Unauthenticated API access-control bypass in vBulletin (pre-auth RCE chain) CVE-2025-48827 is an access-control flaw in vBulletin's API layer: when the software runs on PHP 8.1 or later, methods marked as 'protected' in API controllers can be invoked by completely unauthenticated users. It is triggered simply by requesting a protected method through the front controller, e.g. /api.php?method=<protectedMethod>, with no credentials or user interaction required. An attacker gains the ability to call internal controller methods that were never intended to be exposed externally, and publicly documented attacks chain this with a companion vBulletin flaw to achieve pre-authentication remote code execution. Anyone running vBulletin 5.0.0 through 5.7.5 or 6.0.0 through 6.0.3 on PHP 8.1 or later is affected, making forum operators the primary exposure group. The bug was exploited in the wild in May 2025, a public exploit write-up is available, and EPSS assigns a 75.8% probability of exploitation within 30 days (99th percentile), although it is not yet in CISA's KEV catalog. Do: Upgrade all vBulletin 5.7.x and 6.0.x installations to the vendor's patched releases (issued May 2025); as an interim mitigation, restrict or block unauthenticated access to /api.php. Verify the PHP version in use, since the flaw only manifests on PHP 8.1 or later, and review web-server logs for requests that invoke protected controller methods via /api.php. | 9.8 group max | 76% | PoC |
| largetens of thousands of internet-exposed vBulletin forums (only those on PHP 8.1+) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 195.3.221.137 | ” Dewhurst wrote . “Lo and behold, some IP based in Poland (195.3.221.137) was actively exploiting it!” “This is hardly surprising se |
Full article431 words · extracted from securityaffairs.com · click to collapse
Experts found two vulnerabilities in the vBulletin forum software, one of which is already being exploited in real-world attacks.
Two critical vBulletin flaws, tracked as CVE-2025-48827 and CVE-2025-48828, enable API abuse and remote code execution. The experts warn that one of these flaws is actively exploited in the wild.
An unauthenticated user could exploit CVE-2025-48827 (CVSS score of 10) to invoke protected API controllers’ methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern.
The second flaw, tracked as CVE-2025-48828 (CVSS score of 9), can be exploited by attackers to run arbitrary PHP code by abusing template conditionals.
Both vulnerabilities were exploited in the wild in May 2025.
The vulnerabilities affect vBulletin versions from 5.0.0 to 5.7.5 and from 6.0.0 to 6.0.3, specifically when the platform is running on PHP 8.1 or newer.
Security researcher Egidio Romano discovered the two vBulletin vulnerabilities on May 23, 2025. These vulnerabilities allow attackers to exploit template conditionals and misuse protected methods, resulting in remote, unauthenticated code execution. The researcher also published a PoC exploit for these issues.
“For defenders and developers: now is a good time to review your frameworks and custom APIs. If you’re dynamically routing controller methods through Reflection, audit whether you’re enforcing access restrictions robustly. Look at how your application behaves across different PHP versions, and always assume that method visibility alone is not a security boundary.” reads the analysis published by Romano.
“For researchers: this vulnerability class might be ripe for further exploration. My quick survey of popular PHP platforms suggests that while vBulletin is the most egregious case, others may have similar patterns waiting to be exploited. Custom CMS platforms, internal admin panels, legacy enterprise code — all of these are candidates.”
By May 26, exploit attempts were seen in the wild targeting the vulnerable replaceAdTemplate API endpoint, giving attackers potential server access.
On May 26, researcher Ryan Dewhurst confirmed that the vulnerability was being actively exploited in the wild, as shown by attempts recorded on his honeypot.
“While browsing through our Honeypot data this morning for hours looking to see if any of our signatures had been triggered, I remembered seeing mention of the vBulletin vulnerability on Twitter over the weekend and decided to investigate.” Dewhurst wrote. “Lo and behold, some IP based in Poland (195.3.221.137) was actively exploiting it!”
“This is hardly surprising seeing as there’s a Nuclei template for it since May 24th, 2025.” the researcher added.
Below is the timeline for this vulnerability.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, vBulletin)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/178481/security/two-flaws-in-vbulletin-forum-software-are-under-attack.html