HIGH

CVE-2026-61524

2026-08-03 CVSS v3.1

CVSS

7.2

Description

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file. Attackers can place the malicious archive through the module installation interface, causing the application to extract the webshell into a web-accessible modules/ subdirectory where it becomes immediately executable by any unauthenticated user via direct HTTP request.

Weakness (CWE)

CWE-434 Unrestricted File Upload

EPSS Score

0.56%

Probability of exploitation in next 30 days

45.1th percentile

References

https://addon.websitebaker.org/en/browse-add-ons/?type=5&cid=997 https://medium.com/@benjaminasareagyapong2006/two-rce-vulnerabilities-i-found-on-my-birthday-evening-4563006a615a https://www.vulncheck.com/advisories/websitebaker-cms-file-upload-rce-via-module-installation

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE