CVE-2026-16623 is a code injection vulnerability (CWE-94) in the Create Block WordPress plugin prior to version 2.10.0. The vulnerability arises from improper escaping of user input before writing it into a PHP pattern file. A multisite subsite administrator with specific capabilities can exploit this to execute arbitrary PHP code on the server, bypassing normal capability restrictions on PHP file editing.

Successful exploitation allows a multisite subsite administrator to execute arbitrary PHP code on the server, potentially leading to full server compromise or unauthorized actions beyond their intended permissions. This elevates the privileges of the subsite administrator in the multisite WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict multisite subsite administrator capabilities to trusted users only and monitor for suspicious activity related to PHP file generation. Avoid granting unnecessary permissions that could enable exploitation.