CVE-2025-48827: vBulletin unauthenticated protected API method invocation on PHP 8.1+

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, confirmed in-the-wild exploitation, and an EPSS above the 99th percentile make this an urgent patch.

What it is

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 on PHP 8.1 or later lets unauthenticated users invoke protected API controller methods, as shown by the /api.php?method=protectedMethod pattern. The flaw is a CWE-424 access-control bypass that exposes internal methods to anyone who can reach the endpoint. It matters because the record states it was exploited in the wild in May 2025.

Impact

An attacker can call protected controller methods without credentials, which can lead to remote code execution and full compromise of the forum. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable over the network through the vBulletin API endpoint, for example /api.php?method=protectedMethod. No authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

The description states it was exploited in the wild in May 2025, and a reference is tagged Exploit. It is not listed in CISA KEV, but EPSS is 0.75844 (99.499th percentile), indicating very high predicted exploitation activity.

What to do

• Upgrade vBulletin to a version later than 5.7.5 or 6.0.3, or apply the vendor fix for this issue.
• If immediate patching is not possible, restrict or block access to /api.php from untrusted networks and review any custom API exposure.
• Ensure the server is not running an affected vBulletin release on PHP 8.1 or later without the fix; the flaw is tied to that PHP version.
• Monitor vBulletin security advisories and vendor guidance for the exact patched release, since the record does not name one.
• After patching, rotate administrative credentials and review for signs of prior compromise.

Detection

• Search web and API logs for requests to /api.php with method parameters naming protected or internal controller methods.
• Alert on unauthenticated requests to vBulletin API endpoints that return success for methods normally requiring login.
• Hunt for unusual POST or GET patterns to api.php from single source IPs or with abnormal method names.
• Review server logs around May 2025 for exploitation attempts matching the described pattern.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.