CVE-2026-61523

Name of the Vulnerable Software and Affected Versions WebsiteBaker CMS versions prior to 2.13.10

Description A code injection issue exists in the Droplets editor. Authenticated administrators can inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written to a publicly accessible PHP file without content sanitization. This allows the use of the save droplet handler to save a PHP webshell to a predictable path within the modules directory, enabling unauthenticated users to achieve remote code execution via direct HTTP requests to the created file.

Recommendations Update WebsiteBaker CMS to version 2.13.10 or later.