WebsiteBaker up to 2.13.9 Droplets Editor modules save_droplet Code code injection

Summaryinfo

A vulnerability was found in WebsiteBaker up to 2.13.9. It has been declared as problematic. This impacts the function save_droplet of the file modules of the component Droplets Editor. Executing a manipulation of the argument Code can lead to code injection. This vulnerability is handled as CVE-2026-61523. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in WebsiteBaker up to 2.13.9 and classified as problematic. This vulnerability affects the function save_droplet of the file modules of the component Droplets Editor. The manipulation of the argument Code with an unknown input leads to a code injection vulnerability. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable path inside the modules directory, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file.

The advisory is shared for download at medium.com. This vulnerability was named CVE-2026-61523 since 07/10/2026. The exploitation appears to be easy. The attack can be initiated remotely. The exploitation needs additional levels of successful authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.

Upgrading to version 2.13.10 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• WebsiteBaker

Version

• 2.13.0
• 2.13.1
• 2.13.2
• 2.13.3
• 2.13.4
• 2.13.5
• 2.13.6
• 2.13.7
• 2.13.8
• 2.13.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion