CVE-2026-16623CWE-94code-injection

CVE-2026-16623

High · published August 4, 2026

CVSS v3.1
8.0
EPSS
0%
Percentile
38.7
In the wild
Unconfirmed
What it is

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00457 · 38.7th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-04T11:16Z
References (1)
https://wpscan.com/vulnerability/19c7fdaa-5e75-481d-884c-68fdb2fb8f8d/ · [email protected]
EPSS history
Timeline
  • 04 AUG 06:00Z
    Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)
    cvelistv5