vBulletin's Third Template-Engine RCE in 14 Months Now Has a Public Exploit — EPSS Already Says 70%
CVE-2026-61511 was patched quietly on July 1. A working proof-of-concept landed July 27. Its two predecessors from last year were both exploited in the wild within days of going public.
On June 25, 2026, researcher Egidio Romano reported an unauthenticated remote-code-execution bug in vBulletin's template engine. The vendor patched it fast — five days, then a full point release a week later. Then, on July 27, Romano's own disclosure firm published a working proof-of-concept. That's the moment vBulletin has been here before, twice, in the last fourteen months — and both previous times, the exploitation followed within days.
Scores as of 2026-08-30live record →
How one page number becomes code execution
The bug lives in vB5_Template_Runtime::runMaths(), inside /includes/vb5/template/runtime.php. That function powers vBulletin's {vb:math} template tag — it takes a math expression out of a template variable and runs it through PHP's eval(). Before doing that, it runs the input through a regex meant to strip everything except digits, parentheses and arithmetic/bitwise operators.
The problem: digits, parentheses and operators (including XOR) are enough on their own to build working PHP. Researchers call the technique "phpfuck" — constructing function calls and executable logic entirely out of punctuation and numbers, with no letters for a blocklist to ever catch. Because the page-navigation template feeds the user-controlled pagenav[pagenumber] parameter straight into a {vb:math} expression, and that template renders through the unauthenticated ajax/render/[template] route, no login is required at any point in the chain.
The disclosure timeline
CVE-2026-61511, start to public exploit
- Romano reports the flaw to vBulletinVia SSD Secure Disclosure's private channel.
- Vendor ships a patchPatch Level 1 backported to 6.2.1, 6.2.0 and 6.1.6.
- vBulletin 6.2.2 releasedThe fully patched build for the 6.x line. Cloud-hosted sites were already updated.
- CVE-2026-61511 assigned
- Public advisory + working PoC publishedSSD Secure Disclosure and Karma Insecurity (KIS-2026-13) both publish technical writeups; TheHackerNews independently verifies the exploit executes.
What's confirmed vs. what isn't
- Unauthenticated, pre-auth eval injection via CWE-95
- Reachable through the default pagenav template, no admin access needed
- Vendor patch existed nearly a month before public disclosure
- A working interactive PoC (PHP CLI shell) is public
- Only the 6.x line (up to 6.2.1) is confirmed patched
- No confirmed in-the-wild exploitation as of this writing
- Not on CISA's KEV catalog as of this writing
- Whether unpatched instances were hit quietly during the 4-week gap before disclosure
- Whether vBulletin 5.x installs (through 5.7.5) received an equivalent fix — vendor guidance points 5.x users to upgrade rather than patch in place
vBulletin's template engine, three times over
CVE-2026-61511 isn't an isolated incident. In May 2025, the same researcher disclosed two other pre-auth RCEs in vBulletin's template layer — a protected-API-method bypass and a template-conditional injection — and CVE records for both explicitly note they were "exploited in the wild in May 2025." The pattern each time: vendor patches quietly, a public PoC follows weeks later, and unpatched internet-facing forums get hit.
| CVE | Mechanism | CVSS | EPSS (current) | Confirmed exploited in the wild |
|---|---|---|---|---|
| CVE-2025-48827 | Unauth protected-API-method invocation (PHP 8.1+) | 10.0 | 75.8% (99.5th pct.) | Yes — May 2025 |
| CVE-2025-48828 | Template-conditional injection bypass | 9.0 | 57.6% (99.0th pct.) | Yes — May 2025 |
| CVE-2026-61511 | Eval injection via runMaths() / phpfuck bypass | 9.8 | 70.8% (99.4th pct.) | Not yet confirmed |
That last row's EPSS score is the tell. A model trained on exactly this vendor's exploitation history is already rating CVE-2026-61511's odds of attack within 30 days close to what its two proven-exploited predecessors scored — before anyone has confirmed a single attack against it.
What to check right now
- Identify every self-hosted vBulletin instance on 6.2.1 or earlier (including 6.2.0 and 6.1.6) and confirm it's on the July 1 patch level or 6.2.2.
- If you're still on the 5.x line (through 5.7.5), treat vendor guidance to "upgrade to a newer release" as the operative advice — there's no confirmed 5.x-specific patch in the public record.
- vBulletin Cloud customers were already patched by the vendor — verify rather than assume, especially for any customized templates layered on top.
- Watch access logs for POST requests to
ajax/render/pagenavwith unusualpagenav[pagenumber]values — that's the specific path this bug rides in on. - Don't wait for a KEV listing to act. EPSS at the 99.4th percentile, on a vendor with two out of two prior template CVEs exploited within days of PoC release, is itself the signal.
Vulnerability data as of 2026-08-30