CVE-2026-61524

HighCVSS 7.2

Published: 03/08/2026(UTC)Updated: 03/08/2026(UTC)Translated: 04/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

43th percentile - higher than 43% of all known CVEs

Summary

WebsiteBaker CMS before version 2.13.10 allows authenticated administrators to upload crafted ZIP archives containing a PHP webshell during module installation. After extraction, the webshell is accessible to any unauthenticated user via HTTP.

Risk Assessment

An attacker administrator can achieve remote code execution, and then any unauthenticated user can run the webshell, leading to full compromise of the CMS server.

Recommendation

Update WebsiteBaker CMS to version 2.13.10 or later. Restrict administrator privileges and verify uploaded archives.

Other vulnerabilities in WebsiteBaker CMS

CVE-2026-61523High
WebsiteBaker CMS before version 2.13.10 has a code injection vulnerability in the Droplets editor. An authenticated administrator can save arbitrary PHP code in the Code field, which is written to a publicly accessible file, enabling remote code execution by unauthenticated users.

Original NVD description (English source)

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file. Attackers can place the malicious archive through the module installation interface, causing the application to extract the webshell into a web-accessible modules/ subdirectory where it becomes immediately executable by any unauthenticated user via direct HTTP request.