MyBB Limited ACP Privilege Escalation to Full Admin (mybb-limited-acp-to-admin PoC)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•1

This rule monitors for the execution of known exploit scripts targeting MyBB forum software. It specifically detects the use of 'mybb_limited_acp_to_admin.py', as well as Python and PHP processes executing command lines that contain indicators of MyBB administrative control panel (ACP) exploitation, such as unauthorized user creation with administrator privileges (gid=4).