CVE-2026-61523

This vulnerability is not a security bug — it is a feature working exactly as designed. The Droplets functionality in WebsiteBaker allows administrators to save PHP snippets that execute elsewhere in the CMS. The flaw is that these snippets are written to a predictable path inside the modules directory, which the web server serves without restriction. Once you write a webshell to that path, authentication becomes irrelevant: anyone who can hit the URL executes the code, regardless of credentials. The CVSS 7.2 rating captures the technical severity but obscures the real risk. Authentication as a prerequisite means little in practice — admin credentials are frequently obtained through credential stuffing, phishing, insider threats, or trivially exploitable flaws elsewhere in the same CMS. The attack chain requires admin access plus one HTTP request to a predictable endpoint. There are no race conditions, blind execution, or complex prerequisites. The fix that matters: output must be stored outside the webroot, with server-side inclusion routing the code execution. Path randomization inside a served directory is security theater — it makes the target marginally harder to find but does nothing to break the universal exploitation window once a file is written. Critical remediation gap: patching the vulnerability does not remove the webshell. If an instance was already compromised, the planted file persists indefinitely. Your incident response must include filesystem inspection of the modules directory for unfamiliar PHP files, not just applying the vendor patch. The vulnerability has a CVSS score; the exploitation artifact does not self-delete.

Reviewed through automated stages and approved by a human before publication.