<- ALL CYBER NEWS
Critical
vBulletin, CVE-2025-48827, CVE-2025-48828, pre-auth RCE, PHP, public exploit, forum software
vBulletin Pre-Auth RCE Public Exploit: CVE-2025-48827
A public exploit is out for vBulletin pre-auth RCE CVE-2025-48827 / CVE-2025-48828, reaching PHP eval() unauthenticated. EPSS is 99th percentile - patch now.
A public exploit released on 27 July chains two patched vBulletin flaws - CVE-2025-48827 (CVSS 10.0) and CVE-2025-48828 (CVSS 9.0) - into unauthenticated remote code execution, reaching PHP's eval() with no login. Their EPSS scores sit in the 99th percentile. If your forum is unpatched, treat it as already being scanned.
What happened. Researchers published working exploit details on July 27 for two vBulletin vulnerabilities that were patched earlier but are now trivially weaponisable. CVE-2025-48827 (CVSS 10.0, CWE-424) lets unauthenticated users invoke protected API controller methods on PHP 8+; CVE-2025-48828 (CVSS 9.0) abuses template conditionals in the template engine to execute arbitrary PHP. Chained, an unauthenticated request reaches eval() and runs code on the server.
How exploitable is this really?
Detail | CVE-2025-48827 | CVE-2025-48828 |
|---|---|---|
CVSS | 10.0 Critical (CWE-424) | 9.0 Critical (CWE-424) |
Effect | Unauth access to protected API methods | Arbitrary PHP via template conditionals |
Affected | vBulletin 5.0.0-5.7.5, 6.0.0-6.0.3 (PHP 8+) | Certain vBulletin versions |
EPSS | 77.4% (99.5th percentile) | 60.2% (99.1th percentile) |
Public exploit | Yes, since 27 July | Yes, since 27 July |
Who is affected. Anyone running vBulletin 5.x/6.x on PHP 8. EPSS in the 99th percentile plus a public PoC is about as strong a "you will be scanned" signal as exists.
Is there a patch for CVE-2025-48827?
Yes - vBulletin patched these before the exploit dropped. The danger now is the gap between "patch exists" and "patch applied": community reports point to active, automated scanning for unpatched forums. A WAF rule can blunt the request pattern, but it is a stopgap, not the fix.
What should you do now?
Update vBulletin to a patched release immediately. If you cannot patch within the hour, put the forum behind a WAF rule blocking the known request pattern and restrict admin/API endpoints, then patch. Review web logs for unauthenticated requests hitting API controllers or template-render paths.
Our read. "Patched" is only half a fix - the exploitable window is the time between the vendor's patch and yours, and a public PoC collapses that window to zero. Point-in-time scanning tells you a CVE exists; it does not tell you whether your specific, internet-facing forum is reachable and unpatched right now. That gap is what automated mass-scanners live in.
Reporting by The Hacker News; severity and affected versions per NVD; exploit probability per FIRST.org EPSS. Sources linked above.
Related: Fastjson 1.x RCE with no patch and our KEV pentest analysis.