Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.
An attacker cleverly creates malicious template code using alternative PHP function call syntax — for example, notation like "var_dump"("test") — embedded in template conditionals (Template Conditionals). The vBulletin template engine processes such prepared code without effective filtering of dangerous constructs, allowing it to bypass security control mechanisms. As a result, an attacker gains the ability to execute arbitrary PHP instructions in the context of the application server.
An attacker can take full control of the server hosting vBulletin, which includes data leakage (C:H), modification or deletion of content (I:H), and disruption of service availability (A:H). The vulnerability is agentless and requires no authentication or user interaction.
Patches available from the vendor must be applied immediately according to the references. Additionally, it is recommended to restrict template editing capabilities to trusted administrators only and monitor server logs for unexpected PHP function calls in the context of the template engine.
Specific versions of vBulletin (versions indicated in vendor references and related security researcher analyses)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HVbulletin
APPVbulletin6.0.3
Related vulnerabilities
vBulletin 5.x — zdalne wykonanie kodu (RCE) przez subWidgets
RCE bez uwierzytelnienia w vBulletin 5.x przez parametr widgetConfig[code]
vBulletin — nieautoryzowany dostęp do chronionych metod API (RCE)
vBulletin RCE przez deserializację bez uwierzytelnienia (pre-5.6.9 PL1)
vBulletin 5.5.4–5.6.2: RCE przez niekompletną łatę CVE-2019-16759