Which versions of WebsiteBaker CMS are affected by CVE-2026-61524?

WebsiteBaker CMS versions before 2.13.10 contain a file upload vulnerability that enables remote code execution when administrator credentials are compromised.. A patch is available.

Is there a public PoC exploit available for CVE-2026-61524?

Yes, a public proof-of-concept exploit is available for CVE-2026-61524. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2026-61524?

Within 24 hours, inventory all WebsiteBaker CMS instances to identify those running versions before 2.13.10 and prioritize internet-facing deployments. Within 7 days, upgrade all affected installations to version 2.13.10 or later to apply the vendor-released patch; if immediate patching is not feasible, restrict access to the module installation feature to internal networks only and disable the feature if not in use. Within 30 days, verify patch deployment through configuration scanning or vulnerability re-assessment, and review administrator account access logs for evidence of unauthorized module installations.

WebsiteBaker CMS CVE-2026-61524

Q: What is the CVSS score of CVE-2026-61524?

CVE-2026-61524 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-52394 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-03 VulnCheck

GHSA-m28x-gxhp-6x88

File Upload RCE PHP Websitebaker Cms

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable upload requires admin auth (PR:H); webshell executes within same server scope (S:U) with full CIA impact once placed.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 18:17 vuln.today

CVE Published

Aug 03, 2026 - 17:19 cve.org

HIGH 8.6

DescriptionCVE.org

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file. Attackers can place the malicious archive through the module installation interface, causing the application to extract the webshell into a web-accessible modules/ subdirectory where it becomes immediately executable by any unauthenticated user via direct HTTP request.

AnalysisAI

WebsiteBaker CMS before 2.13.10 exposes remote code execution through an unrestricted file upload flaw (CWE-434) in its module installation feature, allowing authenticated administrators to plant a PHP webshell that any unauthenticated internet user can subsequently trigger via direct HTTP request. The CVSS 4.0 vector scores 8.6 with PR:H, reflecting the administrator credential requirement, but the two-phase attack model means post-upload exploitation requires zero authentication. A public proof-of-concept has been published on Medium; the vulnerability is not currently listed in the CISA KEV catalog.

Technical ContextAI

WebsiteBaker CMS is a PHP-based open-source content management system. The module installation feature accepts ZIP archives and extracts their contents into the web-accessible modules/ subdirectory without adequately validating file types contained within the archive (CWE-434: Unrestricted Upload of File with Dangerous Type). An attacker can embed a PHP webshell alongside a legitimate info.php metadata file to satisfy any basic structural validation, causing the application to extract and persist the malicious PHP file in a directory served directly by the web server. Because PHP files in that path are interpreter-executed on request, the webshell becomes immediately callable by any HTTP client. The affected CPE is cpe:2.3:a:websitebaker_org_e.v.:websitebaker_cms:*:*:*:*:*:*:*:*, covering all versions prior to 2.13.10.

RemediationAI

Upgrade WebsiteBaker CMS to version 2.13.10 or later immediately; the vendor patch is available at https://addon.websitebaker.org/en/browse-add-ons/?type=5&cid=997. If patching cannot be performed immediately, restrict access to the admin panel's module installation interface at the network perimeter or web server level by IP allowlisting, preventing an attacker who obtains credentials from reaching the vulnerable endpoint - note this does not protect against insider threats or attackers already on the allowed network. As an additional defense-in-depth measure, configure the web server to deny PHP execution within the modules/ subdirectory (e.g., via an .htaccess directive php_flag engine off or an nginx location block returning 403 for .php files in that path), which breaks the second phase of the attack even if a webshell is uploaded; be aware this may prevent legitimate PHP-based modules from functioning. Audit the modules/ directory for any unexpected .php files as an indicator of prior compromise.