[tgmorris]

I just got hit by this and it took me several hours to track down the root cause. I'm not about to spend a great deal of $$$ at this point to see what Photopost suggested as the solution so I came up with my own.

I trust the user community so I just added a plugin at the ppgal_misc_email_image hook

PHP Code:

if (!$vbulletin->userinfo['userid'])
{
    print_no_permission();
} 


This will result in the spammer getting a "No permission" screen instead of the form they're looking for. I probably could have gotten a bit fancier and checked the usergroup permissions but this will work for me. Hopefully, this will solve the problem.

UPDATE: I checked the server logs this morning and the user tried & failed today so it looks like the hole is closed for now.