CVE-2026-61523: WebsiteBaker CMS Code Injection Vulnerability

CVE-2026-61523 Overview

CVE-2026-61523 is a code injection vulnerability [CWE-94] in WebsiteBaker CMS versions before 2.13.10. The flaw exists in the Droplets editor, where the save_droplet handler writes the user-supplied Code field verbatim into a PHP file inside the modules directory without sanitization. Authenticated administrators can submit malicious PHP through this field to plant a webshell at a predictable path. Once written, any unauthenticated user can trigger remote code execution by sending a direct HTTP request to the resulting PHP file.

Critical Impact
Authenticated administrators can plant an unauthenticated PHP webshell, enabling full remote code execution on the underlying web server.

Affected Products

WebsiteBaker CMS versions prior to 2.13.10
Droplets add-on module (save_droplet handler)
PHP applications hosting the vulnerable modules directory

Discovery Timeline

2026-08-03 - CVE-2026-61523 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-61523

Vulnerability Analysis

WebsiteBaker CMS implements a Droplets feature that lets administrators create reusable snippets containing PHP code. The save_droplet handler accepts the contents of the Code field from an authenticated administrator and writes it directly to a PHP file inside the modules directory. No sanitization, escaping, or allow-listing is performed on the submitted content.

Because the destination file is publicly reachable over HTTP and executed by the PHP interpreter, any code an administrator submits becomes runnable server-side. An attacker with administrator credentials can save a webshell and then invoke it directly with an HTTP request, bypassing the authentication that guarded the editor. This converts an administrator-only feature into an unauthenticated RCE primitive once the file has been written.

Root Cause

The root cause is improper control of generation of code [CWE-94]. The save_droplet routine treats attacker-controlled input as source code and persists it to a web-accessible .php file. There is no separation between data and executable content, and the output path is predictable inside the modules directory.

Attack Vector

Exploitation requires an authenticated administrator session but no user interaction. The attacker submits a droplet whose Code field contains a PHP payload, for example a system() or passthru() call keyed to a request parameter. After the save completes, the attacker requests the predictable module path directly and executes commands as the web server user. Full technical details are available in the VulnCheck Security Advisory and the researcher writeup Two RCE Vulnerabilities I Found.

Detection Methods for CVE-2026-61523

Indicators of Compromise

New or modified .php files inside the WebsiteBaker modules/droplets/ directory that were not created during a known deployment window.
HTTP requests from unusual client addresses to droplet PHP files carrying query parameters such as cmd, c, or exec.
Web server process spawning shell interpreters (/bin/sh, bash, cmd.exe) or LOLBins after serving a droplet file.
Outbound network connections initiated by the PHP-FPM or Apache worker to unexpected destinations shortly after a droplet save event.

Detection Strategies

Alert on file creation or modification events under the WebsiteBaker modules directory that contain PHP function calls like eval, system, assert, or base64_decode.
Correlate authenticated administrator POST requests to the save_droplet endpoint with subsequent GET requests to newly written module files.
Inspect web server access logs for direct hits on droplet PHP files that include command execution query strings.

Monitoring Recommendations

Enable file integrity monitoring on the modules/ tree and flag any write from the web application user outside of upgrade windows.
Capture process ancestry for the PHP interpreter and alert when it spawns interactive shells or reconnaissance utilities.
Forward web access logs and process telemetry to a centralized analytics platform to enable correlation across the save and execution stages.

How to Mitigate CVE-2026-61523

Immediate Actions Required

Upgrade WebsiteBaker CMS to version 2.13.10 or later on all instances.
Audit the modules/droplets/ directory for unauthorized PHP files and remove any that were not created by legitimate administrators.
Rotate administrator credentials and review admin account activity for signs of misuse.
Restrict administrator access to the CMS backend by IP allow-list or VPN where feasible.

Patch Information

WebsiteBaker resolved the issue in version 2.13.10. Administrators should download the current release from the Website Baker Add-ons Directory and follow the vendor upgrade procedure. Confirm the version reported in the admin interface after the upgrade completes.

Workarounds

Remove or disable the Droplets add-on until the upgrade is applied.
Configure the web server to deny direct HTTP access to files under the modules directory when they are not required for public rendering.
Enforce strict file permissions so the web server user cannot write into module directories at runtime.

bash

# Example: block direct execution of droplet PHP files in Apache
<Directory "/var/www/websitebaker/modules/droplets">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>