Executive brief
WebsiteBaker is a content management system used to build and manage websites. This vulnerability allows authenticated administrators to upload malicious PHP files disguised as legitimate modules, which are then executed by the web server and accessible to any visitor, enabling complete takeover of the website and underlying server.
Technical details
WebsiteBaker CMS before version 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature. The vulnerability exists because the application does not properly validate file contents within uploaded ZIP archives during module installation. An authenticated administrator can craft a malicious ZIP archive containing a PHP webshell alongside a valid info.php metadata file. When uploaded through the module installation interface, the application extracts both files into the web-accessible modules/ subdirectory. The webshell becomes immediately executable and is reachable by any unauthenticated user via direct HTTP request, resulting in remote code execution. The vulnerability requires administrative authentication to trigger, but once exploited, arbitrary code execution is achieved without further authentication needed. WebsiteBaker 2.13.10 and later versions contain patches for this issue.
Affected products
- WebsiteBaker WebsiteBaker CMS before 2.13.10
Timeline
- 2026-08-03: disclosed: CVE-2026-61524 published
- 2026-08-09: patched: WebsiteBaker 2.13.10 released with fix