A critical vulnerability in vBulletin versions 5.0.0 to 5.5.4 allows visitors to run arbitrary PHP code and shell commands on servers.