Pre-auth PHP eval injection in vBulletin template runtime runMaths() via ajax/render (CVE-2026-61511)
VulnCheck added this to its known-exploited catalog today with its canary sensors registering exploitation attempts and full public exploit code circulating, so unpatched forums are being probed for unauthenticated takeover right now.
The vB5_Template_Runtime::runMaths() method evals attacker-controlled input from the pagenav[pagenumber] parameter, and its restrictive-looking regex filter can be bypassed with phpfuck-style encoding using only permitted characters. The unauthenticated ajax/render template route lets a remote attacker execute arbitrary PHP on the forum server with no credentials.
Affected: vBulletin >= 5.0.0, <= 5.7.5; vBulletin >= 6.0.0, <= 6.2.1
How to Test
Confirm your vBulletin version is 5.0.0–5.7.5 or 6.0.0–6.2.1; review web server logs for requests to the ajax/render route carrying pagenav[pagenumber] parameters with unusual encoded payloads.
How to Patch
Upgrade to vBulletin 6.2.2, or apply the vendor security patches released for 6.2.1, 6.2.0, and 6.1.6; 5.x installations should be upgraded off the affected branch as no patched 5.x release is listed.