CVE-2026-16623

8 HIGH

Published 2026-08-04 · Updated 2026-08-04

AI risk analysis

Summary: The flaw allows a multisite subsite administrator to inject and execute arbitrary PHP code by not properly escaping user-supplied text, posing a significant security risk.
Exploitability: Exploitation requires the attacker to have the capability to create a block, but not the capability to edit PHP files, making it somewhat complex but feasible.
Blast radius: If exploited, the arbitrary PHP code can be executed on the server, potentially leading to full server compromise and data loss.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Create Block WordPress plugin version 2.10.0 or later.

rcewebphpwordpress

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-94

References

https://wpscan.com/vulnerability/19c7fdaa-5e75-481d-884c-68fdb2fb8f8d/

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.