CVE-2026-16623: 
WordPress vulnerability analysis and mitigation

CVE-2026-16623 is a PHP code injection vulnerability (RCE) in the Create Block Theme WordPress plugin affecting all versions before 2.10.0. The flaw allows a multisite subsite administrator to inject and execute arbitrary PHP code on the server by exploiting insufficient escaping of user-supplied text written into generated PHP pattern files. It was publicly disclosed on July 24, 2026, and assigned a CVSS score of 8.0 (High) (WPScan). The vulnerability was discovered and reported by researcher Pavan Saxena (Rootkid) (WPScan).

The root cause is improper neutralization of user-controlled input before it is written into a server-side PHP pattern file generated by the plugin (CWE-94: Improper Control of Generation of Code). When a multisite subsite administrator saves a block pattern, the plugin fails to escape special characters in the user-supplied text, allowing PHP code to be embedded directly into the generated file. This is particularly impactful in a WordPress multisite context because subsite administrators hold the capability to trigger this pattern-save action but are normally denied the capability to edit PHP files directly — effectively bypassing that access control boundary. A proof-of-concept is scheduled for public release on August 7, 2026, per WPScan's coordinated disclosure timeline (WPScan, GitHub Advisory).

Successful exploitation grants an attacker arbitrary PHP code execution on the web server in the context of the WordPress process, enabling full server compromise. An attacker could read, modify, or delete files; exfiltrate sensitive data including database credentials; install backdoors or web shells; and potentially pivot to other systems on the same network. The vulnerability is particularly dangerous in shared hosting or multisite environments where subsite administrators are not fully trusted, as it allows privilege escalation beyond their intended access level (WPScan).

1. Reconnaissance: Identify WordPress multisite installations running the Create Block Theme plugin at a version below 2.10.0. This can be done by checking the plugin version in the WordPress admin panel or by inspecting publicly accessible readme files.
2. Obtain subsite administrator access: Gain credentials for a multisite subsite administrator account, either through phishing, credential stuffing, or by being a legitimate but malicious subsite admin.
3. Navigate to pattern save functionality: Log in to the WordPress subsite admin dashboard and access the Create Block Theme plugin's pattern management interface.
4. Inject malicious PHP payload: When saving a block pattern, craft the pattern name or content field to include arbitrary PHP code (e.g., <?php system($_GET['cmd']); ?>) that will be written unescaped into the generated PHP pattern file.
5. Trigger code execution: Access the generated PHP pattern file directly via the web server (e.g., via a known file path under the theme or plugin directory) to execute the injected PHP code and achieve remote code execution on the server (WPScan).

• File System: Unexpected or modified PHP pattern files in the WordPress theme or Create Block Theme plugin directory containing obfuscated or suspicious PHP code (e.g., system(), exec(), eval(), base64_decode() calls); new web shell files in the WordPress installation directory.
• Logs: WordPress access logs showing POST requests to pattern-save endpoints by subsite administrator accounts, followed by GET requests to generated PHP pattern files with query parameters (e.g., ?cmd=); PHP error logs showing unexpected code execution from pattern files.
• Process: Unusual child processes spawned by the web server process (e.g., Apache or Nginx spawning bash, curl, wget, or python).
• Network: Outbound connections from the web server to unknown external IPs, particularly following pattern-save actions by subsite administrators.

The primary remediation is to update the Create Block Theme WordPress plugin to version 2.10.0 or later, which correctly escapes user-supplied text before writing it into PHP pattern files (WPScan, GitHub Advisory). As an interim workaround, restrict multisite subsite administrator privileges to fully trusted users only, and audit existing subsite administrator accounts for unauthorized access. Additionally, monitor PHP pattern files for unauthorized modifications and consider implementing a Web Application Firewall (WAF) rule to detect PHP code injection attempts in pattern-save requests.

The vulnerability was discovered by independent researcher Pavan Saxena (Rootkid) and responsibly disclosed through WPScan. No significant vendor statements, notable researcher commentary beyond the original disclosure, or major media coverage have been identified at this time (WPScan).