CVE-2026-61511 – Immediate guide for vBulletin admins

What is CVE-2026-61511?

A remote attacker can run arbitrary PHP code on a vBulletin forum without any authentication. The flaw is rated 9.8 (CRITICAL) on the CVSS scale and was published on 27 July 2026.

We keep a daily-updated list of vulnerabilities CISA has confirmed as actively exploited, including remediation deadlines.

Anyone who runs a vBulletin site – whether a small hobby board or a large commercial community – needs to know whether this applies to them and what to do about it.

How the flaw works

The vulnerable code lives in the vB5_Template_Runtime::runMaths() method. This method processes mathematical expressions that appear inside templates. It does so by feeding the expression to eval() after a regex filter has stripped out anything it thinks is unsafe.

Unfortunately the regex is far too permissive. An attacker can craft a string that passes the filter but still contains PHP code when interpreted in a “phpfuck‑style” encoding. The crafted string is supplied via the pagenav[pagenumber] parameter, which the front‑end passes straight to the template engine when the AJAX endpoint /ajax/render is called.

Because the endpoint does not require a logged‑in user, anyone on the internet can send a request like:

POST /ajax/render HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded

pagenav[pagenumber]=

The payload makes its way through the weak regex, lands in eval(), and is executed with the same privileges as the web server. In practice that means full control of the PHP process – file read/write, database access, creation of new admin accounts, you name it.

The NVD description is short, but the class of vulnerability is clear: an injection point that bypasses a poorly written sanitiser and ends up in an eval() call. That combination is a textbook remote code execution vector.

Is your site vulnerable?

The only way to know is to check the version of vBulletin you are running and compare it to the list of patched releases. The official table of affected and fixed releases is provided below the article – don’t guess, look at that table.

If you can’t see the table, run the following checks on the server that hosts the forum.

• Locate the vBulletin root directory. Typical paths are /var/www/html/vbulletin or /home/username/public_html. Adjust as needed.
• Search for the file that defines the vulnerable method:

grep -R "function runMaths" /path/to/vbulletin

If the file includes/class_template_runtime.php (or a similarly named file) contains a call to eval() inside runMaths, you are looking at the vulnerable code path.

• Check whether the AJAX route is reachable. The simplest test is to request it with a harmless parameter:

curl -s -o /dev/null -w "%{http_code}" "https://your‑forum.com/ajax/render?pagenav[pagenumber]=1"

A 200 response means the endpoint is live. If you get a 404 or 403, the route may have been disabled by a prior hardening step, but you should still verify the template runtime file.

Finally, confirm the exact vBulletin release you are running. The version string is stored in includes/upgrade.php or can be displayed in the Admin Control Panel under “Version”. Run:

grep -i "\$VERSION" /path/to/vbulletin/includes/upgrade.php

Take the output and match it against the table below. If your release appears in the “Affected” column, you need to apply the fix immediately.

Mitigation steps

Assuming the table shows a patched release for your branch, the remediation is straightforward:

1. Back up your database and files. A full dump protects you if anything goes wrong during the upgrade.
2. Download the patched release. Grab it from the official vBulletin download portal. Do not rely on third‑party mirrors.
3. Replace the core files. Overwrite the existing includes/ directory with the one from the patch. Preserve any custom plugins or modifications that sit outside the core tree.
4. Run the upgrade script. Visit https://your‑forum.com/install/upgrade.php and follow the on‑screen instructions. This will apply any database migrations required by the new version.
5. Clear caches. Delete the contents of includes/cache/ and any opcode cache (e.g. APCu) you may be using.

After the upgrade, re‑run the grep command from earlier. You should no longer see an eval() call inside runMaths. The vulnerability is gone.

If you cannot upgrade for any reason, apply temporary mitigations:

• Block the AJAX endpoint at the web server level. For Apache add:

RedirectMatch 403 ^/ajax/render$

• For Nginx add:

location = /ajax/render { return 403; }

This stops unauthenticated attackers from reaching the vulnerable code path. It will also break any legitimate features that rely on that endpoint, so test thoroughly.

• Deploy a Web Application Firewall rule that drops requests containing the pagenav[pagenumber] parameter when the request URI is /ajax/render. Most commercial WAFs allow a simple pattern match.

These mitigations buy you time, but they are not a substitute for a proper patch.

What to do if no patch is yet available

In the rare case that the table shows no fixed release for your branch, you have three options:

1. Back‑port the fix. The patch essentially removes the eval() call and replaces it with a safe arithmetic parser. If you have a developer comfortable with PHP, they can edit class_template_runtime.php to drop the eval() line and use preg_replace_callback with a whitelist of operators. Test in a staging environment before pushing to production.
2. Restrict access. As described above, block the AJAX route and any other entry points that invoke the template runtime. Combine this with a strict mod_security rule that only allows numeric values for pagenav[pagenumber].
3. Move to a supported version. If the vendor has already released a newer branch that contains the fix, plan a migration. This often involves exporting the database, installing the newer branch, and importing the data. Follow the vendor’s migration guide.

While you work on a longer‑term solution, monitor your logs for any attempts to hit /ajax/render with unusual parameters. An example grep pattern:

grep -i "ajax/render" /var/log/apache2/access.log | grep pagenav

If you see repeated hits, consider tightening your firewall rules further or enabling rate‑limiting.

Summary

CVE-2026-61511 is a critical remote code execution bug in the vBulletin template engine. It lets anyone on the internet run PHP code by sending a crafted value to the pagenav[pagenumber] field of the unauthenticated AJAX render route. The fix is to upgrade to the patched release for your vBulletin branch – see the table below for the exact releases. If you cannot upgrade immediately, block the offending endpoint and add WAF rules to filter the vulnerable parameter.

Check your installation, apply the upgrade, and verify the vulnerable code is gone. That will close the door on this high‑severity issue.

Affected versions

NVD has not published machine-readable version ranges for CVE-2026-61511 yet. Check the vendor advisory for the exact affected and fixed releases before you plan an upgrade.