CVE-2026-61523 describes a code injection vulnerability in WebsiteBaker CMS before version 2.13.10. The flaw exists in the Droplets editor where authenticated administrators can submit malicious PHP code in the droplet Code field. This code is written verbatim to a PHP file accessible publicly, without any content sanitization. Consequently, attackers can save a PHP webshell via the save_droplet handler to a known path inside the modules directory. This webshell can then be accessed by unauthenticated users to achieve remote code execution on the server.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary PHP code on the affected server, leading to full system compromise. This can result in unauthorized access, data theft, service disruption, and further attacks within the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious activity related to droplet creation or modification. Avoid exposing the modules directory publicly if possible.