CVE-2026-61523 WebsiteBaker Org e.V. CVE debrief

Who should care

Administrators and security teams responsible for WebsiteBaker CMS deployments should assess exposure and apply patches or updates to version 2.13.10 or later. They should also review access to the Droplets editor, monitor for suspicious activity, and implement compensating controls. Additionally, they should verify patch application and vulnerability remediation, track exceptions, and retest remediated assets.

Why it matters

CVE-2026-61523 is a high-severity code injection vulnerability in WebsiteBaker CMS that allows authenticated administrators to inject arbitrary PHP code, leading to remote code execution by unauthenticated users. Administrators and security teams should assess exposure and apply patches.

• Remote code execution by unauthenticated users
• Potential for malicious PHP code execution
• Compromise of WebsiteBaker CMS deployments
• Verification of patch application and vulnerability remediation

Technical summary

The vulnerability allows authenticated administrators to inject arbitrary PHP code through the Droplets editor in WebsiteBaker CMS before version 2.13.10. The injected code is written to a publicly accessible PHP file, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file. This can lead to potential malicious PHP code execution, compromise of WebsiteBaker CMS deployments, and other operational impacts. The vulnerability has a CVSS score of 8.6 and is considered high-severity.

Defensive priority

High priority for administrators and security teams to assess exposure and apply patches

Recommended defensive actions

• Assess exposure by checking if the current version of WebsiteBaker CMS is vulnerable
• Apply patches or updates to version 2.13.10 or later
• Review and restrict access to the Droplets editor for authenticated administrators
• Monitor for suspicious activity and implement compensating controls
• Verify patch application and vulnerability remediation
• Track exceptions and retest remediated assets
• Close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the exact scope of affected versions and deployments requires verification. The vendor and product names are confirmed. Affected deployments should be identified, and patch application should be verified. The Droplets editor's access should be reviewed and restricted if necessary. Monitoring for suspicious activity is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.