CVE-2026-16623
Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)
- State
- Published
- Severity
- 8.0 High
- Published
- Aug 4, 2026
- Updated
- Aug 4, 2026
- Reserved
- Jul 22, 2026
Description
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.0 High | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
Create Block ThemeUnknown |
|
References
- https://wpscan.com/vulnerability/19c7fdaa-5e75-481d-884c-68fdb2fb8f8d/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.