Overview

CVE-2026-16623 is a critical vulnerability in the Create Block WordPress plugin that affects versions before 2.10.0. This vulnerability allows a multisite subsite administrator, who typically does not have the capability to edit PHP files, to inject and execute arbitrary PHP code on the server. This can lead to a complete compromise of the server's confidentiality, integrity, and availability.

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of this vulnerability is the lack of proper escaping of user-supplied text before it is written into a generated PHP pattern file. This allows an attacker with the capability to create blocks in a multisite subsite to inject PHP code that can be executed by the server. This vulnerability is classified under CWE-94, which involves the improper control of name resolution for user-controlled data.

Attack Surface & Vector

The attack surface for this vulnerability is the Create Block WordPress plugin, specifically the functionality that generates PHP pattern files from user-supplied text. An attacker needs to be a multisite subsite administrator to exploit this vulnerability. The attack vector is through the plugin's functionality that allows the creation of blocks, which can be used to inject malicious PHP code.

Exploitation Mechanics — Scenario Walkthrough

Scenario: Compromising a Corporate WordPress Multisite Instance 1. Initial Position: The attacker is a multisite subsite administrator on a corporate WordPress multisite instance that uses the Create Block plugin version 2.9.0. 2. Triggering the Flaw: The attacker crafts a specially designed block that includes malicious PHP code. When the block is created, the plugin fails to properly escape the code, writing it directly into a PHP pattern file. 3. What Breaks: The security boundary that normally prevents a multisite subsite administrator from editing PHP files fails because the plugin does not correctly validate or escape the user-supplied input. This allows the execution of arbitrary PHP code. 4. Attacker's Prize: The attacker can now execute arbitrary PHP code on the server, potentially leading to a full compromise of the server. This could involve data exfiltration, lateral movement within the network, or deployment of malware.

Real-World Impact

The real-world impact of this vulnerability can be significant. An attacker could exploit this vulnerability to gain unauthorized access to sensitive data, disrupt service, or use the compromised server as a pivot point for further attacks. Given that the vulnerability has a CVSS score of 8, it is considered high severity and should be addressed promptly.

Detection & Defense

Immediate Mitigations

- Upgrade the Create Block WordPress plugin to version 2.10.0 or later.

Detection Strategies

- Monitor plugin version updates and ensure that version 2.10.0 or later is installed. - Implement a Web Application Firewall (WAF) to detect and prevent suspicious PHP code injection attempts. - Regularly audit user activities, especially those of multisite subsite administrators.

Long-Term Hardening

- Implement a robust content security policy (CSP) to define which sources of content are allowed to be executed within a web page. - Use a secure coding practice that includes proper input validation and output encoding. - Regularly update and patch WordPress plugins and themes.

Key Takeaways

- CVE-2026-16623 is a high-severity vulnerability in the Create Block WordPress plugin that allows for arbitrary PHP code injection. - The vulnerability is due to a lack of proper escaping of user-supplied text. - Multisite subsite administrators can exploit this vulnerability. - Upgrading to version 2.10.0 or later mitigates the vulnerability. - Regular monitoring and security practices can help detect and prevent exploitation.

Sources

- National Vulnerability Database (NVD): https://nvd.nist.gov/vuln/detail/CVE-2026-16623 - WPScan: https://wpscan.com/vulnerability/19c7fdaa-5e75-481d-884c-68fdb2fb8f8d/