High severity7.2NVD Advisory· Published Aug 3, 2026· Updated Sep 9, 2026

CVE-2026-61524

Description

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file. Attackers can place the malicious archive through the module installation interface, causing the application to extract the webshell into a web-accessible modules/ subdirectory where it becomes immediately executable by any unauthenticated user via direct HTTP request.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Website Baker/Websitebakerllm-fuzzy
Range: <2.13.10

Patches

Vulnerability mechanics

References

addon.websitebaker.org/en/browse-add-ons/nvd
medium.com/@benjaminasareagyapong2006/two-rce-vulnerabilities-i-found-on-my-birthday-evening-4563006a615anvd
www.vulncheck.com/advisories/websitebaker-cms-file-upload-rce-via-module-installationnvd

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000