To debug this, in config.php add under <?php
PHP Code:
define("DISABLE_HOOKS", true);
If this fixes the problem, remove this and disable your plugins one by one to find the security flaw.
If it is yet to be fixed, you'll need to do a check on the plugins created under the product, "vBulletin." Sometimes some users' will try to create a plugin here.
Check the template "FORUMHOME" as well.