Understanding and Defending Against CVE-2026-16623: A Code Injection Vulnerability in Create Block WordPress Plugin
CVE-2026-16623 is a high-severity vulnerability in the Create Block WordPress plugin that allows a multisite subsite administrator to inject and execute arbitrary PHP code on the server. This vulnerability has a CVSS score of 8 and is classified under CWE-94. The vulnerability exists because the plugin does not correctly escape user-supplied text before writing it into a generated PHP pattern file.