CVE-2025-48827 vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running

What is CVE-2025-48827?

CVE-2025-48827 is a critical vulnerability in Vbulletin Vbulletin, published on 27 May 2025.

Official description

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.

Weakness: CWE-424

Which versions are affected by CVE-2025-48827?

It affects 1 product.

Products include Vbulletin Vbulletin.

How do I fix CVE-2025-48827?

No fix has been published for CVE-2025-48827 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-48827 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-48827 exists.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 3 proofs of concept on GitHub.

Other vulnerabilities in Vbulletin Vbulletin

• CVE-2020-17496 vBulletin PHP Module Remote Code Execution Exploited Critical 9.8
• CVE-2019-16759 vBulletin PHP Module Remote Code Execution Exploited Critical 9.8
• CVE-2023-25135 Deserialization in n/a Critical 9.8
• CVE-2020-7373 Code injection in n/a Critical 9.8
• CVE-2020-12720 SQL injection in n/a Critical 9.8

All Vbulletin Vbulletin vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-23fp-mrfv-cwv4.