Log in / Sign up

Vulnerability details

CVE-2026-61523

WebsiteBaker Org e.V. WebsiteBaker CMS

WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor

CVSS 4.0
8.6High

Official description

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable path inside the modules directory, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file.

CVSS scores

ScoreVersionSourceVector
8.6High 4.0 CVEProject cvelistV5 (CNA) (VulnCheck) CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
7.2High 3.1 CVEProject cvelistV5 (CNA) (VulnCheck) CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersionsSource
WebsiteBaker Org e.V. WebsiteBaker CMS v < 2.13.10 CVEProject cvelistV5 (CNA)

References and advisories

3
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-08-03
Last updated
2026-08-14
State
Published
Assigner (CNA)
VulnCheck

Exploit prediction (EPSS)

1.18%
Probability of exploitation in 30 days
68%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
Proof of concept
Technical impact
Total

Weaknesses (CWE)

  • CWE-94
    Improper Control of Generation of Code ('Code Injection')