CVE-2026-61523
HIGH
MEDIUM
Priority: 0.10
BB Relevance:
62/100
Published: 2026-08-03
Modified: 2026-10-23
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
High
UI:
None
S:
X
AT:
None
VC:
High
VI:
High
VA:
High
Description
WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable path inside the modules directory, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file.