PT-2026-67667

CVE-2026-16623

Published

2026-07-24

Updated

2026-08-04

Description by

CVSS 3.1

8.0

High

MetricsAV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Create Block WordPress plugin versions prior to 2.10.0

Description Insufficient escaping of user-supplied text occurs before it is written into a generated PHP pattern file. This allows a multisite subsite administrator, who possesses the capability to perform this action but is restricted from editing PHP files, to inject and execute arbitrary PHP code on the server.

Recommendations Update Create Block WordPress plugin to version 2.10.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Pavan Saxena

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers