Hacked

[Shadab]

If the hacker has access to your vBulletin Forum's admin account and it's a Super Administrator account and/or has the permissions to 'manage' plugins; then yes, he can alter/create files on your server. Doesn't matter if you have 3'rd party addons installed or not.

So; Stock vBulletin or not, if he gets access to your admin account, theres nothing stopping him to create his own plugins from your account to run raw PHP code on the Forum. (unless of course that particular admin account doesn't have the permission to alter plugins).