Hi everyone,
I found a critical, unauthenticated remote code execution vulnerability in VirtueMart core — confirmed present in the current release (4.6.4 "Eagle owl"), affecting every up-to-date VirtueMart installation, not just outdated ones. A single unauthenticated GET request is enough, no login, no CSRF token.
I reported this privately to Milbo in late August specifically to avoid publishing a working exploit before a fix ships. It's now been over a week with no response.
Given the severity — this is being actively exploited in the wild, we lost a production site to it — I don't think it's responsible to keep sitting on it silently while waiting indefinitely. I'd like to escalate this to the VirtueMart core team directly rather than post exploit details here.
Could someone from the core team reach out so I can share the full technical write-up, proof of concept, and a suggested fix directly? I'm still not looking to go public with the details — just need this in front of someone who can act on it.
Thanks
Anyone? Guys, there's a serious security issue that could allow anyone to hack a site running VM—it happened to me. Who on the dev team can I contact? Milbo isn't replying, and I don't know anyone else who's actually part of the team. Also, I think I picked the wrong forum section to ask this.
Hi the 4.6.4 is very old now
https://virtuemart.net/news/list-all-blogs
you should go for 4.8
You can pm me if you want
Is this issue still present in 4.8.2.11343? And have you tried contacting on "Discord" (https://forum.virtuemart.net/index.php?board=142.0)? It's the main communication platform for VM development now.
Thanks for the reply.
I can confirm the security issue I reported privately is still present in the latest release, 4.8.2 (build 11343) — it is not fixed there.
I won't post any specifics here, since this is a public thread and the issue is serious. I have the full details, a proof of concept and supporting evidence ready to share privately.
Before I send them, I need to be sure I'm sending to an actual member of the core development team. Could you confirm your affiliation in whatever way you consider appropriate? Once I can verify it, I'll send everything straight away.
Thanks for handling this responsibly.
this one?
Token validation
Token checks added to backend controllers and frontend forms. Unauthorized form submissions are now rejected.
OP already said it's not yet fixed. Besides RCE is much more serious than missing CSRF tokens. This could be another Sourcerer/Helix/JCE type disaster if not fixed ASAP.
Quote from: PRO on September 14, 2026, 17:27:53 PMToken checks added to backend controllers and frontend forms. Unauthorized form submissions are now rejected.
No, guys, it is not about token.
Thanks for token implementation, anyway.
Please, provide any information about your core-team affiliation, and i'll share RCE to you