High severity8.0NVD Advisory· Published Aug 4, 2026· Updated Aug 26, 2026
CVE-2026-16623
CVE-2026-16623
Description
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <2.10.0
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.