CVE-2026-61523
WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable path inside the modules directory, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file.
| CWE | CWE-94 |
| Vendor | websitebaker org e.v. |
| Product | websitebaker cms |
| Published | Aug 3, 2026 |
| Last Updated | Aug 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for websitebaker org e.v. websitebaker cms
Be the first to know when new high vulnerabilities affecting websitebaker org e.v. websitebaker cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
WebsiteBaker Org e.V. / WebsiteBaker CMS
0 < 2.13.10
References
medium.com: https://medium.com/@benjaminasareagyapong2006/two-rce-vulnerabilities-i-found-on-my-birthday-evening-4563006a615a addon.websitebaker.org: https://addon.websitebaker.org/en/browse-add-ons/?type=5&cid=997 vulncheck.com: https://www.vulncheck.com/advisories/websitebaker-cms-code-injection-via-droplets-editor
Credits
Benjamin Agyapong Asare