Vulnerability · Published Aug 3, 2026 · Assigned by VulnCheck

CVE-2026-61524WebsiteBaker CMS < 2.13.10 File Upload RCE via Module Installation

High 7.2

In plain English

A high-severity unrestricted file upload in WebsiteBaker CMS from WebsiteBaker Org e.V.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.0%top 36.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file. Attackers can place the malicious archive through the module installation interface, causing the application to extract the webshell into a web-accessible modules/ subdirectory where it becomes immediately executable by any unauthenticated user via direct HTTP request.

Affected products (as reported)

Vendor	Product	Versions
WebsiteBaker Org e.V.	WebsiteBaker CMS	0 – before 2.13.10

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Researcher Disclosure technical-description, exploit
WebsiteBaker Download Page product, patch
https://www.vulncheck.com/advisories/websitebaker-cms-file-upload-rce-via-module-installation third-party-advisory