A critical, unauthenticated remote code execution (RCE) vulnerability in vBulletin forum software is being actively exploited. The vulnerability, assigned CVE-2025-48827 and CVE-2025-48828, affects versions 5.0.0 through 6.0.3. Despite patches being available for over a year, numerous installations remain vulnerable. The flaw allows attackers to execute arbitrary commands on vulnerable servers without authentication. Organizations running unpatched versions face significant risk as the vulnerability affects a broad range of installations.

A newly discovered vulnerability in vBulletin, a popular forum platform, has exposed thousands of online communities to the risk of unauthenticated remote code execution (RCE). The flaw allows attackers to invoke protected internal methods, enabling full system compromise without authentication. The vulnerability is present in vBulletin versions 5.x and 6.x running on PHP 8.1 or later. The issue arises from vBulletin’s reliance on PHP’s Reflection API for its custom MVC framework and API system, which allows the invocation of protected and private methods without requiring setAccessible(true). This has been confirmed in versions 5.1.0, 5.7.5, 6.0.1, and 6.0.3 running on PHP 8.1+. The vulnerability is believed to be patched in version 6.0.4.

The open-source forum software vBulletin was exposed to two critical vulnerabilities (CVE-2025-48827 and CVE-2025-48828), enabling remote, unauthenticated code execution (RCE) due to improper PHP Reflection API usage. Exploitation attempts were reported on May 26, leveraging an earlier proof-of-concept by researcher Egidio Romano. The flaws affect versions 5.0.0–5.7.5 and 6.0.0–6.0.3 running on PHP 8.1+, risking full system compromise if unpatched. While no confirmed breaches were detailed in the article, the vulnerabilities pose a severe threat to forums using outdated vBulletin installations, potentially allowing attackers to execute arbitrary commands, steal sensitive user data (e.g., credentials, private messages), or deploy malware—including ransomware—across compromised systems. Historical breaches tied to vBulletin flaws (e.g., 2019’s mass exploits) underscore the risk of large-scale data leaks, reputational damage, and operational disruptions for unpatched deployments. Users were urged to apply 2024 patches or upgrade to v6.1.1 to mitigate exposure.