CVE-2026-61523: WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor
WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the savedroplet handler to a predictable path inside the modules directory, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WebsiteBaker CMSto a version that resolves this vulnerability.Fixed in 2.13.10 - Compensating control
If immediate upgrade is not possible, restrict access to the publicly reachable PHP files under the modules directory (where the save_droplet handler writes droplets) so unauthenticated direct HTTP requests to the predictable droplet path cannot be made.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61523?
The severity of CVE-2026-61523 is classified as high, with a score of 7.2.
How do I fix CVE-2026-61523?
To fix CVE-2026-61523, upgrade WebsiteBaker CMS to version 2.13.10 or later.
What kind of vulnerability is CVE-2026-61523?
CVE-2026-61523 is a code injection vulnerability affecting the Droplets editor in WebsiteBaker CMS.
Who is affected by CVE-2026-61523?
Authenticated administrators using WebsiteBaker CMS before version 2.13.10 are affected by CVE-2026-61523.
What does CVE-2026-61523 allow attackers to do?
CVE-2026-61523 allows attackers to inject arbitrary PHP code, potentially compromising the security of the web application.