CVE-2025-48827 & 48828: How vBulletin’s API and Template Engine Got Weaponized

Daily Security Review

Two critical, actively exploited vulnerabilities in vBulletin forum software—CVE-2025-48827 and CVE-2025-48828—have put thousands of websites at immediate risk of full system compromise. In this episode, we dissect how these flaws, triggered by insecure usage of PHP’s Reflection API and abuse of vBulletin’s template engine, allow unauthenticated attackers to execute arbitrary PHP code and gain remote shell access.

We’ll break down the exploit chain, from protected method invocation via malformed API calls to injection of malicious conditionals, enabling full Remote Code Execution (RCE) in vulnerable versions of vBulletin running PHP 8.1 or later. You’ll learn how attackers are currently weaponizing these bugs in the wild—leveraging public exploit code and scanning endpoints like /ajax/api/ad/replaceAdTemplate to plant backdoors.

We also cover:

• Patch levels and which versions are safe (hint: upgrade to v6.1.1 now)
• Temporary mitigations for legacy vBulletin deployments
• IOC monitoring, containment strategies, and threat hunting advice
• Why dynamic method invocation should never be your access control boundary
• Lessons for developers and sysadmins on avoiding similar reflection-based pitfalls

Whether you run a vBulletin forum or just want to understand the anatomy of a modern web RCE exploit, this episode is your front-row seat to one of 2025’s most serious application-layer vulnerabilities.