CVE-2026-16623 - Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)

Back Back to CVE browser

HIGH

Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)

Published Aug 4, 2026

8.0

HIGH

CVSS 3.1

EPSS 0.46%

Description

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.

Affected products

Vendor n/a Product Create Block Theme Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.10.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Create Block Theme

unaffected

Version	Status	Constraints
0	affected	<2.10.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (1)

https://wpscan.com/vulnerability/19c7fdaa-5e75-481d-884c-68fdb2fb8f8d/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://wpscan.com/vulnerability/19c7fdaa-5e75-481d-884c-68fdb2fb8f8d/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Aug 4, 2026

Updated Aug 4, 2026

Reserved Jul 22, 2026

Link CVE-2026-16623

CISA Vulnrichment

Updated Aug 4, 2026

NVD

Status Deferred

Modified Aug 26, 2026

Link CVE-2026-16623

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-16623