---
id: "CVE-2019-16759"
kind: "vulnerability"
aliases: ["CVE-2019-16759"]
title: "vBulletin vBulletin: vBulletin PHP Module Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.99728
exploited: true
status: "open"
category: "other"
products: [{"name": "vBulletin vBulletin", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "vBulletin", "fixed": ["5.5.2 Patch Level 1", "5.5.3 Patch Level 1", "5.5.4 Patch Level 1"], "affected": ">= 5.0.0, <= 5.5.4 (without Patch Level 1)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "other", "php", "rce", "self-hosted", "unauthenticated", "vbulletin"]
not_affected_if: ["managed-hosting", "vbulletin-not-installed"]
published_at: "2019-09-24T22:15:13+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:58:32+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-16759", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-16759", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16759", "first_seen_at": "2026-10-23T19:35:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:58:32+00:00"}]
---

# vBulletin vBulletin: vBulletin PHP Module Remote Code Execution Vulnerability

vBulletin's PHP widget module lets an unauthenticated remote user send a crafted request to the widget_php route and run arbitrary PHP code on the server. An attacker gets full control of the forum host and its data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:vBulletin vBulletin affected ? fixed ?
- vendor:vBulletin affected >= 5.0.0, <= 5.5.4 (without Patch Level 1) fixed 5.5.2 Patch Level 1, 5.5.3 Patch Level 1, 5.5.4 Patch Level 1

## How to check

Self-hosted vBulletin 5.x: check version in Admin CP footer or the vBulletin version string; 5.0.0 through 5.5.4 without Patch Level 1 is vulnerable. Check whether PHP module rendering is enabled (Admin CP > Settings > Options > General Settings 'Enable PHP, Static HTML, and Ad Module rendering'). Search web logs for requests to ajax/render/widget_php with widgetConfig[code]; look for unexpected webshells and a modified bbcode.php.

## Fix

Apply the vBulletin Security Patch (Patch Level 1) for 5.5.2, 5.5.3 or 5.5.4; users on older 5.x should upgrade to one of those. Workaround: disable PHP, Static HTML and Ad Module rendering in the Admin CP. If exposed before patching, assume compromise: hunt for webshells and altered files (bbcode.php).

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-16759
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-16759
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-16759
- 2026-10-23T20:58:32+00:00 analyst — Affected 5.0.0-5.5.4 and fix (Patch Level 1 for 5.5.2/5.5.3/5.5.4) per Unit 42; vendor announcement URL taken from Unit 42 but not opened by me; exact PL1 build numbers and patch notes for 5.2-5.4 unverified. Exploited in the wild (CISA KEV); no public PoC link found.

## Documents

- [describes] Unit 42: exploits in the wild for vBulletin CVE-2019-16759 https://unit42.paloaltonetworks.com/exploits-in-the-wild-for-vbulletin-pre-auth-rce-vulnerability-cve-2019-16759/
- [fix] vBulletin Security Patch Released: 5.5.2, 5.5.3 and 5.5.4 (not opened; cited by Unit 42) https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4422707-vbulletin-security-patch-released-versions-5-5-2-5-5-3-and-5-5-4

## From the sources

The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_