CVE-2026-61523 in WebsiteBaker
Summary
by MITRE • 08/03/2026
WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable path inside the modules directory, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability represents a critical code injection flaw in WebsiteBaker CMS versions prior to 2.13.10 that stems from inadequate input validation and sanitization within the Droplets editor functionality. The issue manifests when authenticated administrators submit malicious PHP code through the droplet Code field, which gets written directly to publicly accessible PHP files without any content sanitization or security checks. This fundamental failure in data validation creates a pathway for attackers to execute arbitrary code on the target system.
The technical implementation of this vulnerability aligns with CWE-94, which describes improper control of generation of code, specifically highlighting how unvalidated input can lead to code injection attacks. The droplet editor's save_droplet handler functionally operates as a write-what-you-want interface that bypasses all security mechanisms, allowing malicious payloads to be persisted in the modules directory at a predictable path. This predictable file location significantly reduces the attack surface complexity for potential adversaries who can directly access and execute the injected code through HTTP requests.
The operational impact of this vulnerability is severe and far-reaching, as it transforms authenticated administrative access into full system compromise. An attacker with administrator privileges can create persistent backdoors by saving PHP webshells to specific locations within the modules directory, effectively creating a permanent entry point for unauthorized users. This allows unauthenticated attackers to achieve remote code execution simply by making HTTP requests to the predetermined file paths, bypassing authentication mechanisms entirely.
The attack vector demonstrates characteristics consistent with ATT&CK technique T1505.003, which covers "Server Software Component: Web Shell," where adversaries establish persistent access through web-based backdoors. The vulnerability's exploitation requires only administrative access to the CMS and leverages the trust relationship between the application and its administrators. Once successfully exploited, the attacker gains complete control over the web server, potentially enabling data exfiltration, privilege escalation, and further network infiltration. Organizations should implement immediate mitigations including updating to WebsiteBaker CMS version 2.13.10 or later, implementing strict input validation for all user-supplied content, and conducting thorough security reviews of file permissions and directory structures to prevent unauthorized code execution.