CVE-2025-48828

Deeper analysis

Certain vBulletin versions are affected by a vulnerability in the template engine that permits arbitrary PHP code execution through abuse of Template Conditionals. Attackers can bypass existing security checks by supplying template code that uses an alternative PHP function invocation syntax, such as the "var_dump"("test") form, rather than the standard call syntax that the checks expect.

Remote, unauthenticated attackers can exploit the flaw over the network to achieve code execution with high impact on confidentiality, integrity, and availability. The issue was exploited in the wild in May 2025, consistent with its CVSS 3.1 score of 9.0.

Public analyses at the referenced URLs document the bypass technique and its consequences but do not detail official patches or mitigation steps. The EPSS score rose from an initially low value to a peak of 0.8138 on 2026-04-21 before receding to the current 0.7368, indicating emerging exploitation interest after disclosure.