EIP-2026-113010

This exploit leverages an incomplete patch for CVE-2019-16759 in vBulletin 5.4.5 through 5.6.2, allowing pre-authentication remote code execution via a crafted POST request to the 'widget_tabbedContainer_tab_panel' endpoint. The exploit injects PHP code into the 'subWidgets[0][config][code]' parameter, which is then executed by the server.