CVE-2026-61524: WebsiteBaker CMS RCE Vulnerability

CVE-2026-61524 Overview

CVE-2026-61524 is an unrestricted file upload vulnerability in WebsiteBaker CMS versions before 2.13.10. The flaw resides in the module installation feature and allows authenticated administrators to achieve remote code execution. Attackers craft a ZIP archive that pairs a PHP webshell with a valid info.php metadata file, then upload it through the module installer. The application extracts the webshell into a web-accessible modules/ subdirectory, where any unauthenticated user can invoke it via direct HTTP request. The vulnerability is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
An authenticated administrator can obtain full remote code execution on the underlying web server, exposing site data, credentials, and adjacent infrastructure.

Affected Products

WebsiteBaker CMS versions prior to 2.13.10
Deployments using the module installation feature
Any WebsiteBaker instance exposing /modules/ to unauthenticated HTTP access

Discovery Timeline

2026-08-03 - CVE-2026-61524 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-61524

Vulnerability Analysis

WebsiteBaker CMS accepts ZIP archives through the administrative module installation interface. The installer validates the presence of an info.php metadata file but does not enforce restrictions on other archive contents. An attacker who packages an arbitrary PHP file alongside info.php bypasses the intended integrity check.

Once the archive is uploaded, the installer extracts every file into a subdirectory beneath modules/. That directory is served directly by the web server without authentication. The dropped PHP file becomes immediately executable, granting the attacker code execution in the context of the web server process.

Exploitation requires authenticated administrator privileges, which raises the barrier for external attackers but does not stop credential theft, session hijacking, or malicious insider abuse from reaching full compromise. Post-exploitation activity typically includes database credential theft, lateral movement to backend services, and persistence via additional webshells.

Root Cause

The root cause is missing content validation during archive extraction. The installer treats the presence of info.php as sufficient proof of a legitimate module and fails to enforce an allowlist of file types, path constraints, or executable content checks on the remaining archive entries.

Attack Vector

Exploitation follows a two-stage pattern. First, the attacker authenticates to the administrator interface and uploads a crafted ZIP archive containing info.php and a PHP webshell. Second, the attacker issues an unauthenticated HTTP GET request to the extracted webshell path under /modules/<module_name>/shell.php, triggering command execution. Refer to the Vulncheck advisory and the researcher writeup for the exploitation chain.

Detection Methods for CVE-2026-61524

Indicators of Compromise

Unexpected .php files inside modules/<name>/ subdirectories that do not match legitimate module contents
Recent ZIP uploads processed by the module installer without corresponding change management records
Outbound connections or shell activity spawned by the PHP-FPM or Apache worker process shortly after an admin session
HTTP GET requests to newly created /modules/*/ PHP files from external IPs

Detection Strategies

Monitor filesystem writes under the WebsiteBaker modules/ directory and flag creation of executable content by the web server user
Alert on HTTP requests to PHP files in module paths that were installed within the last 24 hours
Correlate administrator authentication events with subsequent module installation actions and post-install PHP execution

Monitoring Recommendations

Enable web server access logging with full URI and user-agent capture for /modules/ paths
Track process ancestry where the web server spawns shells, curl, wget, or interpreters
Ingest CMS audit logs into a central SIEM and retain admin session records for correlation

How to Mitigate CVE-2026-61524

Immediate Actions Required

Upgrade WebsiteBaker CMS to version 2.13.10 or later without delay
Rotate administrator credentials and invalidate active sessions after patching
Audit the modules/ directory for unauthorized PHP files and remove any not tied to a legitimate module
Review web server and application logs for suspicious module installations preceding the patch

Patch Information

Upgrade to WebsiteBaker CMS 2.13.10 or later. Legitimate modules should be sourced only from the official WebsiteBaker add-on directory.

Workarounds

Restrict access to the administrative interface using network ACLs, VPN, or IP allowlists
Enforce multi-factor authentication for all administrator accounts to reduce credential-abuse risk
Configure the web server to deny PHP execution inside modules/ subdirectories where policy allows
Disable the module installation feature for non-essential administrators through role-based access control

bash

# Apache: block PHP execution inside module upload paths
<Directory "/var/www/websitebaker/modules">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>