Critical unauthenticated RCE in VirtueMart core

[d0ublezer0]

Hi everyone,

I found a critical, unauthenticated remote code execution vulnerability in VirtueMart core — confirmed present in the current release (4.6.4 "Eagle owl"), affecting every up-to-date VirtueMart installation, not just outdated ones. A single unauthenticated GET request is enough, no login, no CSRF token.

I reported this privately to Milbo in late August specifically to avoid publishing a working exploit before a fix ships. It's now been over a week with no response.

Given the severity — this is being actively exploited in the wild, we lost a production site to it — I don't think it's responsible to keep sitting on it silently while waiting indefinitely. I'd like to escalate this to the VirtueMart core team directly rather than post exploit details here.

Could someone from the core team reach out so I can share the full technical write-up, proof of concept, and a suggested fix directly? I'm still not looking to go public with the details — just need this in front of someone who can act on it.

Thanks

[d0ublezer0]

Anyone? Guys, there's a serious security issue that could allow anyone to hack a site running VM—it happened to me. Who on the dev team can I contact? Milbo isn't replying, and I don't know anyone else who's actually part of the team. Also, I think I picked the wrong forum section to ask this.

[sirius]

Hi the 4.6.4 is very old now
https://virtuemart.net/news/list-all-blogs
you should go for 4.8

You can pm me if you want

[Ghost]

Is this issue still present in 4.8.2.11343? And have you tried contacting on "Discord" (https://forum.virtuemart.net/index.php?board=142.0)? It's the main communication platform for VM development now.

[d0ublezer0]

Thanks for the reply.

I can confirm the security issue I reported privately is still present in the latest release, 4.8.2 (build 11343) — it is not fixed there.

I won't post any specifics here, since this is a public thread and the issue is serious. I have the full details, a proof of concept and supporting evidence ready to share privately.

Before I send them, I need to be sure I'm sending to an actual member of the core development team. Could you confirm your affiliation in whatever way you consider appropriate? Once I can verify it, I'll send everything straight away.

Thanks for handling this responsibly.