Public Exploit Out for vBulletin Pre-Auth RCE
Working exploit details are now public for a patched pre-auth code execution flaw in vBulletin. Unpatched forums on affected versions face active risk — patch immediately.
airgap Exploit details are public. Flaw is patched. If you’re running vBulletin on an affected version, the gap between those two facts is the problem you solve today.
SSD Secure Disclosure published technical details on July 27 showing how an unauthenticated request can reach PHP’s eval() function inside vBulletin — no account, no admin interaction, no additional prerequisites required. The research was reported by The Hacker News.
Affected versions
Per SSD Secure Disclosure:
- vBulletin 6.2.1 and earlier
- vBulletin 6.1.6 and earlier
Two active version lines are in scope. Lower version bounds were not specified in available disclosures.
Priority call
Patch. vBulletin has issued a fix — apply it. A public exploit against a pre-auth RCE removes the theoretical qualifier from the risk assessment. The question is no longer whether this gets exploited in the wild; it’s whether your unpatched forum already has been.
If patching cannot happen immediately:
- Restrict admin interface access to known IP addresses
- Block untrusted external traffic at the perimeter until the patch is applied
No CVE identifier was available in published disclosures at time of writing. SSD Secure Disclosure did not assign one in available reporting. Absence of a CVE ID does not affect severity — pre-auth arbitrary code execution is high-impact regardless of identifier status.
No CVSS score is available from current disclosures. Treat as critical.
For the latest technical disclosure, see The Hacker News.
Context
This follows a week that also saw n8n patch an expression-sandbox escape — a separate platform, same class of problem: an application-layer code execution flaw where an attacker can reach a code-execution primitive without expected authorization. The vBulletin flaw is worse on one axis — no authentication at all is required, versus an authenticated session in the n8n case.
Forum software runs on a lot of infrastructure that doesn’t get the same patch cadence as enterprise products. If you manage vBulletin installations, the public exploit changes your timeline from “patch in the next cycle” to “patch today.”
Found this useful? Share it.
