CVE-2026-61523 describes a code injection vulnerability in WebsiteBaker CMS prior to version 2.13.10. The flaw exists in the Droplets editor where authenticated administrators can submit malicious PHP code in the droplet Code field. This code is written verbatim to a PHP file in the modules directory without any sanitization. Because the file is publicly accessible, unauthenticated users can access the uploaded PHP webshell and execute arbitrary commands remotely. This vulnerability allows remote code execution without user interaction or additional privileges beyond administrator access to the CMS interface.

Successful exploitation allows an attacker with authenticated administrator access to inject arbitrary PHP code that is saved to a publicly accessible location. Subsequently, unauthenticated attackers can execute remote code by accessing the uploaded PHP file directly. This leads to full remote code execution on the affected server, compromising confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious file uploads or unexpected PHP files in the modules directory. Avoid exposing the modules directory to public HTTP access if possible.