CVE-2025-48827

9.8 criticalEPSS 76%

Critical (9.8) in vbulletin vbulletin. EPSS 76% chance of exploitation in the next 30 days.

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 76% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-424
Published: 2025-05-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

vbulletin:vbulletin

References

https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce
https://kevintel.com/CVE-2025-48827
https://blog.kevintel.com/vbulletin-replaceadtemplate-kev/

Check your stack JSON