vBulletin PHP Module Remote Code Execution Vulnerability (CVE-2019-16759)

What is affected, what to do

The vulnerability CVE-2019-16759 allows remote code execution (RCE) via the widgetConfig[code] parameter in vBulletin PHP module requests. It affects vBulletin versions 5.0.0 to 5.5.4, enabling an unauthenticated attacker to gain full control of the system. This vulnerability is actively exploited in ransomware campaigns. It is crucial to update to the latest version to mitigate this security risk.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• vBulletin lte 5.0.0..5.5.4

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Identify every vBulletin instance running versions 5.0.0 through 5.5.4, including forgotten forums, staging hosts and marketing microsites. Check the AdminCP footer or includes/version_vbulletin.php for the version.
   • Patch: A security patch is available from the vendor. Look up the exact version in the vendor advisory. The original 2019 fix was later bypassed (CVE-2020-17496 via widget_tabbedcontainer_tab_panel). Upgrade to the latest supported vBulletin release, not just the first patch level.
   • Workaround if you cannot patch yet: In the AdminCP, go to Settings → Options → General Settings and set "Disable PHP, Static HTML, and Ad Module rendering" to "Yes". This turns off the vulnerable PHP widget rendering path.
   • Compromise assessment: Treat any internet-facing instance left unpatched since 2019 as compromised until proven otherwise.
     • Hunt the web root for unknown .php files and webshells.
     • Review config.php, plus cron jobs and user crontabs for the web server account (www-data/apache).
   • Credential rotation: If compromise is suspected, rotate the database password from config.php, AdminCP accounts, API keys and SMTP credentials. Also assess whether forum user password hashes were exfiltrated (possible GDPR Art. 33 notification).
   • Isolation: If neither the patch nor the workaround can be applied quickly, take the forum offline or redirect it to a maintenance page at the reverse proxy.
2. 02

   Runbook step 2

   Mitigation layers

   • WAF/reverse proxy: Block requests where the path or the routestring parameter contains ajax/render/widget_php or ajax/render/widget_tabbedcontainer_tab_panel. Also block requests carrying the body parameters widgetConfig[code] or subWidgets[...][config][code]. For ModSecurity with OWASP CRS, add a custom rule on ARGS_NAMES matching widgetConfig\[code\].
   • IPS: On Suricata/Snort, enable the existing ET signatures for CVE-2019-16759 and CVE-2020-17496 in blocking mode rather than alert-only. TLS must be terminated before the sensor.
   • Segmentation and egress: Keep the web server in a DMZ. Restrict outbound traffic to required destinations only (update servers, SMTP relay). This kills wget/curl second-stage downloads and reverse shells. The database should accept connections from the web server only.
   • Endpoint hardening (PHP): Set disable_functions = exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec in php.ini where vBulletin functionality allows. Make the web root read-only for the web server account, except upload and cache directories. Disable PHP execution in upload paths via php_admin_flag engine off or an nginx location block.
   • Least privilege: Limit the database user to the vBulletin schema (no FILE, no SUPER). Restrict the AdminCP with an IP allowlist or VPN and rename its directory.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs: Look for POST requests whose URI or body contains widget_php or widget_tabbedcontainer_tab_panel. SPL example: index=web (uri="*ajax/render/widget_php*" OR form_data="*widgetConfig*code*" OR uri="*widget_tabbedcontainer_tab_panel*") | stats count by src_ip, uri, status. Note that request bodies usually only appear in WAF or mod_security audit logs.
   • EDR process ancestry: Child processes of php-fpm, apache2, httpd or nginx such as sh, bash, dash, curl, wget, perl, python, nc or base64 are high-fidelity indicators. On Windows/IIS, the equivalent is w3wp.exe or php-cgi.exe → cmd.exe/powershell.exe. Sigma shape: ParentImage|endswith: ['/php-fpm','/apache2','/httpd'] AND Image|endswith: ['/sh','/bash','/curl','/wget'].
   • Linux auditd: Rule -a always,exit -F arch=b64 -S execve -F uid=33 -k web_exec (UID 33 = www-data on Debian/Ubuntu; adjust elsewhere). Investigate any hit outside known cron or image-processing jobs.
   • File integrity: Alert on new or modified .php files under the vBulletin tree (Sysmon for Linux EID 11, Wazuh/OSSEC FIM, AIDE). Short files containing eval(, base64_decode(, assert( or $_REQUEST are strong webshell indicators.
   • Network telemetry (Zeek/Suricata): Flag first-seen outbound connections from the web server to unknown IPs or unusual ports. Also flag DNS lookups for paste sites or dynamic-DNS domains shortly after a POST to /ajax/render/.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog

Vendors and products

• vBulletin vBulletin

Weakness classes (CWE)

• CWE-94Improper Control of Generation of Code ('Code Injection')

  Base

  The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

  Entry at MITRE CWE-94

References & sources

• seclists.orgfulldisclosure/2019/Sep/31x_refsource_MISC, Exploit, Mailing list, Third-party advisory
• theregister.co.uk2019/09/24/vbulletin_vbug_zerodayx_refsource_MISC, Press coverage, Third-party advisory
• arstechnica.cominformation-technology/2019/09/public-exploit-code-spawns-mass-…x_refsource_MISC, Exploit, Press coverage, Third-party advisory
• packetstormsecurity.comfiles/154623/vBulletin-5.x-0-Day-Pre-Auth-Remote-Command-Execut…x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/154648/vBulletin-5.x-Pre-Auth-Remote-Code-Execution.htmlx_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/155633/vBulletin-5.5.4-Remote-Command-Execution.htmlx_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/158830/vBulletin-5.x-Remote-Code-Execution.htmlx_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/158829/vBulletin-5.x-Remote-Code-Execution.htmlx_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• seclists.org20200811 Remote Code Execution 0day in vBulletin 5.xMailing list, x_refsource_FULLDISC, Exploit, Mailing list, Third-party advisory
• packetstormsecurity.comfiles/158866/vBulletin-5.x-Remote-Code-Execution.htmlx_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16759government-resource, US government resource