Executive brief
WebsiteBaker is a content management system used to build and maintain websites. A code injection vulnerability in the Droplets editor allows authenticated administrators to inject malicious PHP code that gets saved to publicly accessible files. Attackers can then execute arbitrary code on the server without authentication, leading to complete system compromise and potential data theft.
Technical details
The vulnerability is a code injection flaw in the Droplets editor component of WebsiteBaker CMS. Authenticated administrators can submit arbitrary PHP code through the droplet Code field, which is written verbatim to a publicly accessible PHP file in the modules directory without any sanitization. The malicious code is saved via the save_droplet handler to a predictable file path. An unauthenticated attacker can then directly request this file via HTTP to execute the injected code remotely, achieving unauthenticated remote code execution. The vulnerability affects WebsiteBaker CMS before version 2.13.10, and a security update is available in version 2.13.10 and later.
Affected products
- WebsiteBaker WebsiteBaker CMS before 2.13.10
Timeline
- 2026-08-03: disclosed: CVE-2026-61523 published
- 2026-08-03: patched: Security update released in version 2.13.10