CVE-2026-61523 WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor
Authenticated administrators can inject PHP code via the Droplets editor, allowing unauthenticated attackers to achieve remote code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-61523?
CVE-2026-61523 is a high-severity code injection vulnerability in WebsiteBaker CMS, published on 3 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable path inside the modules directory, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file.
Weakness: CWE-94
Which versions are affected by CVE-2026-61523?
How do I fix CVE-2026-61523?
No fix has been published for CVE-2026-61523 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-61523 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61523 exists.
Sources
Also known as GHSA-wcwf-72hj-3355.