CVE-2026-16623 Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)
A multisite administrator can inject and execute arbitrary PHP code via pattern saving in the Create Block Theme plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16623?
CVE-2026-16623 is a high-severity code injection vulnerability in Unknown Create Block Theme, published on 4 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.
Weakness: CWE-94
Which versions are affected by CVE-2026-16623?
How do I fix CVE-2026-16623?
No fix has been published for CVE-2026-16623 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-16623 being exploited?
There is no known exploitation of CVE-2026-16623 in the wild and no public exploit code.
Sources
Also known as GHSA-6wqp-7cwm-r4gv.