CVE-2026-61524 describes an unrestricted file upload vulnerability in WebsiteBaker CMS prior to version 2.13.10. The flaw exists in the module installation feature, where authenticated administrators can upload a specially crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file. Upon upload, the application extracts the archive into the modules/ subdirectory, which is web-accessible. This allows any unauthenticated user to execute the uploaded webshell remotely via HTTP requests, resulting in remote code execution.

Successful exploitation of this vulnerability allows remote code execution on the affected WebsiteBaker CMS server. An attacker with authenticated administrator access can upload a malicious ZIP archive that results in a webshell being placed in a publicly accessible directory. This webshell can then be accessed by unauthenticated users, enabling them to execute arbitrary code on the server, potentially compromising the entire system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor module installation activities closely. Avoid uploading untrusted modules or ZIP archives through the module installation feature.