CVE-2026-61524 describes an unrestricted file upload vulnerability in WebsiteBaker CMS before version 2.13.10. The flaw exists in the module installation feature, where authenticated administrators can upload a specially crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file. Upon upload, the archive is extracted into the modules/ subdirectory, which is web-accessible. This allows any unauthenticated user to execute the uploaded webshell by making direct HTTP requests, resulting in remote code execution on the server.

Successful exploitation allows remote code execution on the web server hosting WebsiteBaker CMS. This can lead to full system compromise, unauthorized access, data theft, or further attacks originating from the compromised server. The vulnerability requires authenticated administrator privileges to upload the malicious archive but enables unauthenticated users to execute the webshell once uploaded.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor module installation activities closely. Avoid uploading untrusted modules or archives. Follow vendor communications for updates on patches or official mitigations.