CVE-2026-16623— Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)
Possible ATT&CK Techniques 1AI
T1505.003 · Web ShellAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Create Block Theme | < 2.10.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-16623
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)
Source: CVE Program / CVE List V5
Vulnerability Description
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Create Block 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Create Block是WordPress基金会开源的一个区块创建组件。 WordPress Create Block 2.10.0之前版本存在代码注入漏洞，该漏洞源于未正确转义用户提供的文本，可能导致多站点子站点管理员注入并执行任意PHP代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Create Block Theme | 0 ~ 2.10.0 | - |
II. Public POCs for CVE-2026-16623
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16623
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-16623 (1)
- 🔗 Create Block Theme < 2.10.0 – Admin+ PHP Code Injection via Pattern Save (Multisite) | CVE 2026-16623 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-08-04 · 24 CVEs total
| CVE-2026-16056 | Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_op | |
| CVE-2026-16618 | ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execut | |
| CVE-2026-10526 | EmbedPress < 4.6.1 - Unauthenticated Blind SSRF | |
| CVE-2026-11366 | MonsterInsights < 11.1.0 - Unauthenticated Measurement Protocol Secret Update via Empty-Ke | |
| CVE-2026-16536 | Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_i | |
| CVE-2026-12698 | wpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile | |
| CVE-2026-14939 | Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery v | |
| CVE-2026-14816 | The GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Reques | |
| CVE-2026-14872 | Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injectio | |
| CVE-2026-14824 | Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question | |
| CVE-2026-14848 | Paid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process | |
| CVE-2026-16035 | miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send | |
| CVE-2026-16296 | Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler | |
| CVE-2026-15233 | Nested Pages < 3.2.15 - Editor+ Stored XSS via Post Title | |
| CVE-2026-15958 | Easy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access | |
| CVE-2026-16293 | Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL | |
| CVE-2026-16068 | Brizy - Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Co | |
| CVE-2026-16069 | Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point | |
| CVE-2026-16070 | Brizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDOR | |
| CVE-2026-16548 | Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-14204
Google Authenticator < 0.56 - 2FA Secret Overwrite via CSRF - CVE-2026-12713
WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injectio - CVE-2026-13153
Essential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales - CVE-2026-13154
Essential Blocks < 6.4.0 - Unauthenticated Non-Public Custom - CVE-2026-13703
SEO Redirection Plugin – 301 Redirect Manager < 9.19 - Subsc
V. Comments for CVE-2026-16623
No comments yet