CVE-2026-61523
Received Received - Intake

Code Injection in WebsiteBaker CMS via Droplets Editor

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable path inside the modules directory, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-61523
EUVD
EUVD-2026-52393

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
websitebaker cms to 2.13.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

WebsiteBaker CMS before version 2.13.10 has a code injection flaw in the Droplets editor. Authenticated administrators can inject arbitrary PHP code via the droplet Code field. This code is saved without sanitization to a PHP file in a public directory. The file path is predictable, located in the modules folder. Attackers can then execute remote code by accessing this file directly through HTTP requests.

Detection Guidance

Check for unauthorized PHP files in the WebsiteBaker modules directory, particularly files created via the Droplets editor. Look for files with suspicious names or recent modification dates in paths like /modules/.

Impact Analysis

If you use an affected WebsiteBaker CMS version, an attacker with admin access could upload a PHP webshell. This allows them to execute commands on your server, steal data, or take control of your website. Even without admin access, if the vulnerable file is accessible, unauthenticated attackers could exploit it for remote code execution.

Compliance Impact

This vulnerability could lead to data breaches, exposing sensitive user or patient data. For GDPR, it risks unauthorized access to personal data, potentially violating confidentiality and integrity requirements. For HIPAA, it may compromise protected health information, leading to compliance violations and legal penalties.

Mitigation Strategies

Upgrade WebsiteBaker CMS to version 2.13.10 or later. Review and remove any unauthorized PHP files in the modules directory. Restrict administrative access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61523. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart