CVE-2026-16623
Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.
| Vendor | unknown |
| Product | create block theme |
| Published | Aug 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown create block theme
Be the first to know when new unknown vulnerabilities affecting unknown create block theme are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Create Block Theme
0 < 2.10.0
References
Credits
Pavan Saxena (Rootkid) WPScan