{"id":"CVE-2026-16623","published":"2026-08-04T07:16:30.817","lastModified":"2026-08-04T18:16:47.840","description":"The Create Block  WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.","cvssScore":8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/19c7fdaa-5e75-481d-884c-68fdb2fb8f8d/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows a multisite subsite administrator to inject and execute arbitrary PHP code by not properly escaping user-supplied text, posing a significant security risk.","exploitability":"Exploitation requires the attacker to have the capability to create a block, but not the capability to edit PHP files, making it somewhat complex but feasible.","blast_radius":"If exploited, the arbitrary PHP code can be executed on the server, potentially leading to full server compromise and data loss.","remediation":"Upgrade to Create Block WordPress plugin version 2.10.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","php","wordpress"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:46:07.845Z"}}