PHP Code Injection Vulnerability in Create Block Plugin for WordPress
CVE-2026-16623

Currently unrated

Key Information:

Vendor

WordPress
Status
Create Block Theme
Vendor
CVE Published:
4 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-16623?

The Create Block WordPress plugin prior to version 2.10.0 is susceptible to a PHP code injection vulnerability. Due to insufficient escaping of user-supplied text when creating a PHP pattern file, this flaw allows a multisite subsite administrator to inject and execute arbitrary PHP code on the server. This can lead to unauthorized access and execution of malicious scripts. It is crucial for administrators to update to the latest version to mitigate this risk.

Affected Version(s)

Create Block Theme 0 < 2.10.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-16623 - Proof of Concept

References

https://wpscan.com/vulnerability/19c7fdaa-5e75-481d-884c-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pavan Saxena (Rootkid)
WPScan
.