[Dave]

I downloaded the latest version, but it's not safe:
It has a check to see if it's a string, then there's a strtolower function around it. Then the variable is being used in the query without being sanitized.

You should change the following:

$email = strtolower($vbulletin->GPC['email']);

to

$email = $db->escape_string(strtolower($vbulletin->GPC['email']));