CVE-2026-16623 Overview
CVE-2026-16623 affects the Create Block WordPress plugin in versions prior to 2.10.0. The plugin fails to escape user-supplied text before writing it into a generated PHP pattern file. A multisite subsite administrator holding the capability that gates this action, but denied the capability that normally gates PHP file editing, can inject and execute arbitrary PHP code on the server. The flaw is classified under CWE-94: Improper Control of Generation of Code.
Critical Impact
Authenticated subsite administrators can bypass WordPress multisite PHP editing restrictions and achieve remote code execution on the underlying server.
Affected Products
- Create Block WordPress plugin versions before 2.10.0
- WordPress multisite installations exposing the plugin to subsite administrators
- Sites relying on capability separation to prevent PHP file editing
Discovery Timeline
- 2026-08-04 - CVE-2026-16623 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-16623
Vulnerability Analysis
The Create Block plugin generates PHP pattern files based on input supplied by users through the plugin's block creation workflow. The plugin writes this input directly into a .php file that is later executed as part of WordPress rendering. Because the input is not sanitized or escaped for a PHP context, an attacker can embed PHP tags and executable statements inside fields the plugin accepts as text.
WordPress multisite installations enforce a capability separation model. The edit_files and related capabilities are typically restricted so that subsite administrators cannot edit PHP files. This vulnerability circumvents that restriction. A subsite administrator holding the plugin's action capability, but not edit_files, can still cause arbitrary PHP to be written to disk and executed.
Root Cause
The root cause is missing output escaping when generating the PHP pattern file. The plugin treats user input as trusted text data and concatenates it into a PHP source template. No wp_kses, escaping helper, or PHP-context sanitizer processes the value before file write, so attacker-controlled tokens such as <?php and function calls remain intact.
Attack Vector
An authenticated multisite subsite administrator submits crafted text through the plugin's block creation interface. The submitted text embeds PHP code inside a field the plugin serializes into a generated pattern file. Once the pattern file is written under the plugin or theme directory, subsequent requests that load the file execute the attacker's payload with the privileges of the PHP process, typically the web server user. The attack requires network access and existing high privileges on a subsite, and impacts extend beyond the compromised subsite to the entire multisite network.
See the WPScan Vulnerability Report for additional technical details.
Detection Methods for CVE-2026-16623
Indicators of Compromise
- New or modified .php files inside the Create Block plugin's generated patterns directory that contain unexpected function calls such as system, exec, passthru, eval, or base64_decode.
- Pattern files with modification timestamps that correlate to subsite administrator sessions but not to plugin updates.
- Outbound network connections initiated by the PHP-FPM or Apache worker process shortly after pattern file writes.
Detection Strategies
- Monitor file creation and modification events under wp-content/plugins/ and pattern output directories on multisite hosts.
- Alert on WordPress audit log entries where a subsite administrator triggers the Create Block generation action followed by file writes.
- Scan generated pattern files for PHP tags, superglobal references such as $_GET or $_POST, and known webshell signatures.
Monitoring Recommendations
- Enable WordPress activity logging that records plugin-level actions, capability checks, and administrator identities across all subsites.
- Forward web server and PHP error logs to a central analytics platform and alert on process spawn events originating from the web server user.
- Baseline the contents of plugin-generated directories and diff against the baseline on a scheduled cadence.
How to Mitigate CVE-2026-16623
Immediate Actions Required
- Update the Create Block plugin to version 2.10.0 or later on every site in the multisite network.
- Audit subsite administrator accounts and revoke access for accounts that do not require the capability gating Create Block actions.
- Review the plugin's pattern output directory for unexpected .php files and remove any that contain attacker-controlled code.
Patch Information
The vendor addressed the vulnerability in Create Block version 2.10.0 by escaping user-supplied text before writing it to generated PHP pattern files. Administrators should install this release from the WordPress plugin repository. Confirm the installed version through the WordPress admin interface after the update completes.
Workarounds
- Temporarily deactivate the Create Block plugin on multisite networks until the patched version is deployed.
- Restrict the plugin's action capability to network super administrators only, preventing subsite administrators from triggering pattern generation.
- Apply filesystem-level restrictions that block the web server user from writing new .php files under plugin-managed directories.
# Configuration example: locate vulnerable installations and confirm plugin version
wp plugin list --network --format=csv | grep create-block
wp plugin update create-block --version=2.10.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
