CVE-2019-16759

What is vBulletin?

vBulletin is one of the most widely used commercial internet forum software platforms, powering large numbers of online communities, gaming forums, and support sites. Because forums often accumulate years of user data, private messages, and sometimes payment information, vBulletin's PHP codebase has long been a high-value target for attackers.

Overview

CVE-2019-16759 is a critical, unauthenticated remote code execution vulnerability in vBulletin's PHP-based widget rendering system. By sending a crafted request to the ajax/render/widget_php route with malicious PHP code in the widgetConfig[code] parameter, an unauthenticated attacker can execute arbitrary PHP code on the server hosting the forum. CVSS 3.1 base score 9.8 (Critical) — no authentication or user interaction required.

Technical Details

This is CWE-94 (Improper Control of Generation of Code / Code Injection). vBulletin's "PHP" widget type is designed to let forum administrators embed custom PHP snippets into page templates; the routestring ajax/render/widget_php was reachable without authentication and passed the widgetConfig[code] parameter directly into PHP's code evaluation, meaning any unauthenticated visitor could submit and immediately execute arbitrary PHP — a full server-side template/code injection with no access-control gate at all.

Discovery

The vulnerability was disclosed anonymously via a full-disclosure post (including working proof-of-concept exploit code) to a public security mailing list in September 2019, without prior coordinated notice to vBulletin. vBulletin released an emergency patch within a day of disclosure.

Exploitation Context

CISA added CVE-2019-16759 to the KEV catalog in November 2021. Because working exploit code was published simultaneously with disclosure, mass exploitation began within hours — attackers scanned the internet for vulnerable vBulletin forums and used the flaw to deploy web shells, deface sites, mine cryptocurrency, and exfiltrate forum databases (including hashed user credentials) before many administrators had a chance to patch.

Remediation

1. Upgrade vBulletin to the patched version released in response to CVE-2019-16759 (5.5.4 or later, or the applicable patch for your version branch) immediately.
2. If immediate patching is not possible, apply vBulletin's emergency configuration workaround (blocking the widget_php ajax route) as an interim mitigation.
3. Audit the server for web shells or unauthorized files, since exploitation of this bug within hours of disclosure was extremely common.
4. Rotate all administrator and user credentials and review database access logs for signs of exfiltration.
5. Ensure the forum's server, PHP runtime, and any other dependent software are also fully patched, since compromised vBulletin instances were often used as a pivot point for broader server compromise.