CVE-2025-48827 is a critical flaw (CVSS 10.0) in vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 running on PHP 8.1 or later. Unauthenticated users can call protected API controller methods. The record says it was exploited in the wild in May 2025. Apply the vendor's latest patch release now.
What's affected
The CVE record lists vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3. It ties the problem to PHP 8.1 or later. The researcher who published the technical write up tested versions 5.1.0, 5.7.5, 6.0.1 and 6.0.3 on PHP 8.1 or newer.
The write up says the issue was likely patched about a year before the disclosure, and guesses that the protected method problem is fixed starting with 6.0.4, without confirming it. I could not confirm a fixed version from the pages I fetched, so check the vBulletin patch notes and your customer area for the current security patch level before you rely on any version number.
The record's own text says the flaw was exploited in the wild in May 2025. The CISA catalogue flag in the data I used for this review is false, so treat the exploitation statement as coming from the CVE record and the press coverage linked from the researcher's post, and verify it against the current KEV list.
How to check if you're exposed
Work out which version and which PHP runtime you have. On the server:
php -v
In the vBulletin admin area, read the installed version and any patch level shown there. If you run 5.x or 6.x and PHP is 8.1 or later, assume you are in scope until the vendor says otherwise.
Next, read your web server access logs for requests to the API entry point. The record names the pattern of calls to api.php with a method parameter. Look for requests whose method value is not one your own front end or mobile app uses:
grep "api.php" /var/log/nginx/access.log | grep "method=" | tail -n 100
Adjust the log path to your setup. Compare what you find with normal traffic. Unexpected new files in the web root or template changes in the admin area are also worth checking, because the same research describes a second, related issue (CVE-2025-48828) in the template engine.
What to do now
- Identify every vBulletin instance, including old forums and staging copies, and note the version and PHP version.
- Apply the latest security patch release from the vendor. Do not stop at a minor version bump without confirming that it includes the fix.
- Do not treat a PHP downgrade as the fix. The record ties exposure to PHP 8.1 or later, but a vendor patch is the correct remedy.
- Review logs back to May 2025 for odd API calls, then check templates, plugins and the file system for changes you did not make.
- If you find signs of compromise, rotate admin and database credentials and restore from a known clean backup.
- Put the admin area behind an allow list or VPN while you work.
Why it matters
The root cause is described in the record as CWE-424, improper protection of an alternate path. The application used PHP's Reflection API to route API requests to controller methods, and relied on method visibility, protected versus public, as the access boundary. PHP 8.1 changed how reflective calls treat visibility, so methods that were meant to be internal became callable from the outside.
That makes this a design lesson as much as a bug. Visibility keywords are a coding convention, not an authorisation check. Any dynamic router that maps request values to method names needs an explicit allow list of callable methods and an explicit access check on each one.
The CVSS 10.0 score reflects network reach, no privileges, no user interaction and full impact. For a public forum, the result of exploitation described in the research is code execution as the web server user, which gives an attacker the forum database and anything else the web user can read.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does running PHP older than 8.1 remove the risk?
The record limits the described flaw to PHP 8.1 or later, but that is a condition of this particular issue, not a safe configuration. Patch vBulletin and keep PHP supported.
Is a login needed to reach the vulnerable API?
No. The record says unauthenticated users can invoke the protected methods, and the CVSS vector shows no privileges required.
Sources
Last reviewed: 18 October 2026.
