An authenticated remote code execution vulnerability in WebsiteBaker 2.13.0 poses a severe risk, as it allows attackers with language editing permissions to gain full control over the host server.

The application fails to properly validate parameters within the language installation endpoint. This allows an authenticated user with language editing capabilities to inject and execute arbitrary code on the underlying server.

A successful exploit allows an attacker to achieve remote code execution, which grants them the ability to read, modify, or delete sensitive data, install persistent backdoors, or pivot deeper into the internal network. Given the CVSS score of 8.8, this vulnerability is categorized as High severity, representing a significant risk to the confidentiality, integrity, and availability of the application and its host environment.

Immediate Action: Update to the latest version of WebsiteBaker that addresses this security flaw, or apply the specific security patches provided by the vendor.

Proactive Monitoring: Review web server access logs for unusual requests directed at the admin/addons or language installation modules, particularly those originating from user accounts with administrative or language editing privileges.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block suspicious input parameters within administration endpoints, effectively providing a virtual patch for the vulnerability.

Public Exploit Available: Yes, a functional exploit script is available via the Exploit Database (EDB-ID 50310).

The severity of this vulnerability, combined with the availability of a public exploit, necessitates immediate action. Administrators must prioritize updating their WebsiteBaker instances to a patched version to prevent potential system compromise. If an immediate update is not feasible, restrict administrative access to the language management interface to only the most trusted personnel and implement strict monitoring of privileged account activity.