Vanilla Forums has a plain-flavoured zero-day

PHPMailer bug leads to remote code execution via HTTP

The popular Vanilla Forums software needs patching against a remote code execution zero-day first reported to the developers in December 2016."