high8.0
CVE-2026-16623
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a mu…
Impact
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.
Affected products
| Product | Affected versions |
|---|---|
| Create Block WordPress Plugin | before 2.10.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.