Which versions of WebsiteBaker CMS are affected by CVE-2026-61523?

WebsiteBaker CMS before version 2.13.10 contains a code injection vulnerability in its Droplets editor that allows remote code execution on affected systems.. A patch is available.

Is there a public PoC exploit available for CVE-2026-61523?

Yes, a public proof-of-concept exploit is available for CVE-2026-61523. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2026-61523?

Within 24 hours, identify all WebsiteBaker CMS instances running versions prior to 2.13.10 and review administrator account activity for unauthorized Droplets editor modifications-restrict future admin privileges to verified personnel only. Within 7 days, upgrade all affected WebsiteBaker CMS installations to version 2.13.10 or later and verify the patch by confirming the Droplets editor no longer passes unsanitized code to PHP files. Within 30 days, audit all Droplets output files for signs of prior exploitation, implement Web Application Firewall rules to block direct access to the modules directory, and establish mandatory code review before administrators modify Droplets code.

WebsiteBaker CMS CVE-2026-61523

Q: What is the CVSS score of CVE-2026-61523?

CVE-2026-61523 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-52393 HIGH

Code Injection (CWE-94)

2026-08-03 VulnCheck

GHSA-wcwf-72hj-3355

PHP RCE Code Injection Websitebaker Cms

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Admin-level network auth required to write webshell (PR:H), but resulting file enables unauthenticated OS access, constituting a scope change (S:C).

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 18:17 vuln.today

CVE Published

Aug 03, 2026 - 17:18 cve.org

HIGH 8.6

DescriptionCVE.org

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable path inside the modules directory, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file.

AnalysisAI

Code injection in WebsiteBaker CMS before 2.13.10 allows an authenticated administrator to plant a PHP webshell that is subsequently exploitable by unauthenticated remote attackers. The Droplets editor's save_droplet handler writes the Code field verbatim - without any content sanitization - to a publicly accessible PHP file inside the modules directory. Once an admin submits malicious PHP, any unauthenticated user can trigger full remote code execution by issuing a direct HTTP request to the predictable file path. A public proof-of-concept exploit exists; no CISA KEV listing at time of analysis.

Technical ContextAI

WebsiteBaker CMS is a PHP-based content management system (CPE: cpe:2.3:a:websitebaker_org_e.v.:websitebaker_cms:*:*:*:*:*:*:*:*). Its Droplets feature allows administrators to define reusable PHP code snippets through a web interface. The vulnerability is rooted in CWE-94 (Improper Control of Generation of Code / Code Injection): the save_droplet handler accepts arbitrary text from the Code field and persists it to a PHP file on disk with no input validation, output encoding, or content-type enforcement. Because the target file path is inside the publicly served modules directory and is predictable, the written file is immediately reachable over HTTP by any client, decoupling the authenticated write step from the unauthenticated execution step. This two-phase exploitation pattern is a classic PHP CMS webshell class.

RemediationAI

Upgrade to WebsiteBaker CMS 2.13.10 or later, which is confirmed available via the vendor's add-on channel at https://addon.websitebaker.org/en/browse-add-ons/?type=5&cid=997. If immediate upgrade is not possible, the highest-priority compensating control is to restrict HTTP access to the modules directory via web server configuration (e.g., deny all requests matching /modules/*.php via nginx location blocks or Apache .htaccess), which prevents unauthenticated users from executing already-planted webshells; note this does not prevent a malicious admin from writing files. Additionally, enforce strong unique passwords and multi-factor authentication on all WebsiteBaker admin accounts to raise the bar for the prerequisite admin compromise. Audit the modules directory for unexpected PHP files as a detection step. The public exploit is documented at https://medium.com/@benjaminasareagyapong2006/two-rce-vulnerabilities-i-found-on-my-birthday-evening-4563006a615a.