The flaw is a code injection vulnerability in the Droplets editor of WebsiteBaker CMS. An authenticated administrator can submit arbitrary PHP code via the droplet Code field, which is stored without sanitization into a PHP file that is publicly accessible. By doing so the attacker can create a webshell stored at a predictable location inside the modules directory, enabling any user to trigger remote code execution through a straight HTTP request. The vulnerability, classified as CWE‑94, therefore permits full compromise of the affected webserver.

WebsiteBaker Org e.V. – WebsiteBaker CMS, versions earlier than 2.13.10 are affected. No other vendors or products are listed as impacted.

The CVSS score of 8.6 indicates a high‑severity flaw. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it may not yet have widespread public exploitation. However, the attack path is clear: an authenticated admin uploads malicious PHP, which is then placed in a publicly reachable location, allowing unauthenticated users to execute code. Because the droplet file path is predictable, once the webshell is saved it is trivial for an attacker to trigger RCE by simply browsing to that URL. The combination of an authenticated upload requirement and subsequent unauthenticated code execution creates a serious risk of full system compromise.