Vulnerability · Published Aug 3, 2026 · Assigned by VulnCheck

CVE-2026-61523WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor

High 7.2

In plain English

A high-severity code injection in WebsiteBaker CMS from WebsiteBaker Org e.V.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.2%top 32.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable path inside the modules directory, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file.

Affected products (as reported)

Vendor	Product	Versions
WebsiteBaker Org e.V.	WebsiteBaker CMS	0 – before 2.13.10

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Researcher Disclosure technical-description, exploit
WebsiteBaker Download Page product, patch
https://www.vulncheck.com/advisories/websitebaker-cms-code-injection-via-droplets-editor third-party-advisory