This vBulletin vBug is vBad: Zero-day exploit lets miscreants hijack vulnerable web forums • The Register

https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/