Critical unauthenticated RCE in VirtueMart core

[d0ublezer0]

Hello!
I have already posted this important information, but it has so far gone unnoticed.
I suspect I chose the wrong section of the forum for my post:

https://forum.virtuemart.net/index.php?topic=152581.msg544906#msg544906

The matter is important, so I have decided to post it here:

I found a critical, unauthenticated remote code execution vulnerability in VirtueMart core — confirmed present in the current available release (4.8.2), affecting every up-to-date VirtueMart installation, not just outdated ones. A single unauthenticated GET request is enough, no login, no CSRF token.

I reported this privately to Milbo in late August specifically to avoid publishing a working exploit before a fix ships. It's now been over a week with no response.

Given the severity — this is being actively exploited in the wild, we lost a production site to it — I don't think it's responsible to keep sitting on it silently while waiting indefinitely. I'd like to escalate this to the VirtueMart core team directly rather than post exploit details here.

Could someone from the core team reach out so I can share the full technical write-up, proof of concept, and a suggested fix directly? I'm still not looking to go public with the details — just need this in front of someone who can act on it.

Let me clarify once again:
I won't share any details in this public thread, as the issue is serious. I have a full description, a proof of concept, and supporting evidence, and I'm ready to share them privately.

Before I send anything, I need to confirm that I'm talking to a member of the core development team. Please verify your affiliation in whatever way is convenient for you.