CVE-2020-12720: vBulletin access control flaw enables unauthenticated SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required, combined with a very high EPSS probability, makes this an urgent patch target.

What it is

vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 contains incorrect access control that is classified as SQL injection and missing authentication for a critical function. Because the flaw is reachable without credentials and can expose or alter the database, it is a serious risk to any unpatched forum.

Impact

An unauthenticated attacker can execute SQL against the vBulletin database, potentially reading or modifying sensitive data and, depending on database privileges, compromising the underlying host.

Attack surface

The vulnerability is network-reachable with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. It is triggered through the web interface of the affected vBulletin installation.

Exploitation

CVE-2020-12720 is not listed in CISA KEV, but EPSS is very high at 0.88948 (99.77th percentile), and public Packet Storm references describe SQL injection against vBulletin 5.6.1, indicating public technical detail and likely active exploitation.

What to do

• Apply the vendor patch level: upgrade to vBulletin 5.5.6pl1, 5.6.0pl1, or 5.6.1pl1 or later.
• If immediate patching is not possible, restrict network access to the vBulletin application to trusted users or place it behind a WAF with SQL injection rules.
• Run the vBulletin database account with least privilege, avoiding FILE, DROP, and broad write permissions.
• Review database and web logs for unexpected SQL activity and rotate any credentials or secrets that may have been exposed.

Detection

• Monitor web requests to vBulletin endpoints for SQL injection patterns such as UNION SELECT, stacked queries, and time-based payloads.
• Alert on database errors or unusual query volume originating from the web application account.
• Review vBulletin and database logs for unexpected reads or writes to user, session, or configuration tables.
• Correlate outbound connections from the database or web host with known exploitation indicators.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.