{"id":"CVE-2019-16759","kind":"vulnerability","aliases":["CVE-2019-16759"],"related":[],"title":"vBulletin vBulletin: vBulletin PHP Module Remote Code Execution Vulnerability","description":"The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.\n\nCISA required action: Apply updates per vendor instructions.","summary":"vBulletin's PHP widget module lets an unauthenticated remote user send a crafted request to the widget_php route and run arbitrary PHP code on the server. An attacker gets full control of the forum host and its data.","severity":"critical","cvss":9.8,"epss":0.99728,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"vBulletin vBulletin","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"vBulletin","fixed":["5.5.2 Patch Level 1","5.5.3 Patch Level 1","5.5.4 Patch Level 1"],"affected":">= 5.0.0, <= 5.5.4 (without Patch Level 1)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","other","php","rce","self-hosted","unauthenticated","vbulletin"],"not_affected_if":["managed-hosting","vbulletin-not-installed"],"how_to_check":"Self-hosted vBulletin 5.x: check version in Admin CP footer or the vBulletin version string; 5.0.0 through 5.5.4 without Patch Level 1 is vulnerable. Check whether PHP module rendering is enabled (Admin CP > Settings > Options > General Settings 'Enable PHP, Static HTML, and Ad Module rendering'). Search web logs for requests to ajax/render/widget_php with widgetConfig[code]; look for unexpected webshells and a modified bbcode.php.","fix":"Apply the vBulletin Security Patch (Patch Level 1) for 5.5.2, 5.5.3 or 5.5.4; users on older 5.x should upgrade to one of those. Workaround: disable PHP, Static HTML and Ad Module rendering in the Admin CP. If exposed before patching, assume compromise: hunt for webshells and altered files (bbcode.php).","status":"open","published_at":"2019-09-24T22:15:13+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:33+00:00","updated_at":"2026-10-23T20:58:32+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T20:29:33Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per vBulletin instructions (CISA says 'apply updates per vendor instructions'); the fixed version is not stated in the sources.","summary":"vBulletin's PHP widget module lets an unauthenticated remote user send a crafted request to the widget_php route and run arbitrary PHP code on the server. An attacker gets full control of the forum host and its data.","category":"other","who_cares":["vbulletin","php","self-hosted"],"confidence":0.8,"analyst_note":"Find the fixed vBulletin version and the vendor patch/advisory and check whether the widget_php route is present in the install; affected versions are not listed in the sources.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","vbulletin-not-installed"],"severity_if_unknown":"critical"},"cost_usd":0.000358,"input_tokens":2115,"output_tokens":292,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed vBulletin version and the vendor patch/advisory and check whether the widget_php route is present in the install; affected versions are not listed in the sources.","search":"'-16759':12A,15A '-2019':11A,14A 'action':94C 'ajax/render/widget_php':89C 'allow':77C 'appli':95C 'arbitrari':49B 'attack':56B 'cisa':92C 'code':7A,51B,80C,85C 'contain':72C 'control':59B 'craft':40B 'cve':10A,13A 'data':66B 'execut':8A,81C 'exploit':19B 'forum':62B 'full':58B 'get':57B 'host':25B,63B 'instruct':99C 'let':33B 'modul':5A,32B,69C 'paramet':86C 'per':97C 'php':4A,21B,30B,45B,50B,68C 'rce':22B 'remot':6A,36B,79C 'request':41B,91C 'requir':93C 'rout':46B 'routestr':90C 'run':48B 'self':24B 'self-host':23B 'send':38B 'server':54B 'unauthent':26B,35B 'unspecifi':74C 'updat':96C 'user':37B 'vbulletin':1A,2A,3A,16A,17A,18A,27B,28B,71C 'vendor':98C 'via':82C 'vulner':9A,75C 'widget':31B,44B 'widgetconfig':84C 'within':70C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-09-24T22:15:13+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-16759","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-16759","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T12:39:25+00:00","note":null},{"source":"epss","external_id":"CVE-2019-16759","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-16759","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-16759","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16759","severity":null,"published_at":"2019-09-24T22:15:13+00:00","modified_at":"2026-06-17T02:22:44+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2019-16759:34","url":null,"severity":null,"published_at":"2026-10-23T20:58:32+00:00","modified_at":"2026-10-23T20:58:32+00:00","first_seen_at":"2026-10-23T20:58:32+00:00","fetched_at":"2026-10-23T20:58:32+00:00","note":"Affected 5.0.0-5.5.4 and fix (Patch Level 1 for 5.5.2/5.5.3/5.5.4) per Unit 42; vendor announcement URL taken from Unit 42 but not opened by me; exact PL1 build numbers and patch notes for 5.2-5.4 unverified. Exploited in the wild (CISA KEV); no public PoC link found."}],"documents":[{"id":887,"url":"https://unit42.paloaltonetworks.com/exploits-in-the-wild-for-vbulletin-pre-auth-rce-vulnerability-cve-2019-16759/","title":"Unit 42: exploits in the wild for vBulletin CVE-2019-16759","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":888,"url":"https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4422707-vbulletin-security-patch-released-versions-5-5-2-5-5-3-and-5-5-4","title":"vBulletin Security Patch Released: 5.5.2, 5.5.3 and 5.5.4 (not opened; cited by Unit 42)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}