CVE-2026-61524: WebsiteBaker CMS < 2.13.10 File Upload RCE via Module Installation
WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file. Attackers can place the malicious archive through the module installation interface, causing the application to extract the webshell into a web-accessible modules/ subdirectory where it becomes immediately executable by any unauthenticated user via direct HTTP request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WebsiteBaker CMSto a version that resolves this vulnerability.Fixed in 2.13.10 - Compensating control
Restrict/limit access to the WebsiteBaker CMS module installation interface to trusted administrators only, so authenticated administrators are the only accounts that can perform module uploads.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61524?
The severity of CVE-2026-61524 is classified as high with a score of 7.2.
What is CVE-2026-61524 about?
CVE-2026-61524 is an unrestricted file upload vulnerability in WebsiteBaker CMS that allows authenticated administrators to execute remote code via module installation.
How do I fix CVE-2026-61524?
To fix CVE-2026-61524, upgrade WebsiteBaker CMS to version 2.13.10 or later, which addresses this vulnerability.
Who is affected by CVE-2026-61524?
CVE-2026-61524 affects authenticated administrators using versions of WebsiteBaker CMS prior to 2.13.10.
What impact does CVE-2026-61524 have?
The impact of CVE-2026-61524 is potential remote code execution, allowing attackers to manipulate the server with malicious PHP scripts.