Public exploit details for CVE-2026-61511, an unauthenticated remote code execution (RCE) vulnerability in vBulletin’s template engine, were released on July 27, demonstrating how attackers can execute arbitrary PHP code without authentication or user interaction by exploiting the ajax/render/pagenav endpoint and the application’s unsafe use of PHP’s eval() function. Although the proof-of-concept (PoC) contains a minor typo, the flaw is easily corrected and successfully enables command execution. The vulnerability affects vBulletin versions 6.2.1 and earlier and 6.1.6 and earlier, but was patched in late June, with vBulletin 6.2.2 released on July 1; the vendor also confirmed that all cloud-hosted instances have already been secured. There is currently no evidence of active exploitation, and the flaw has not been added to the U.S. Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, though the publication of a working exploit significantly increases the risk to organizations running unpatched, internet-facing self-hosted forums. Affected FLASH Update readers should prioritize applying available patches or upgrading to version 6.2.2 and monitor for suspicious POST requests targeting ajax/render/pagenav with unusually complex pagenav[pagenumber] values, as public exploit availability has historically led to rapid targeting of vulnerable vBulletin deployments.