The Create Block WordPress plugin versions prior to 2.10.0 improperly handle user-supplied input by failing to escape it before writing it into a generated PHP pattern file. This flaw enables a multisite subsite administrator, who holds the capability required for this action but lacks the capability that usually restricts PHP file editing, to inject and execute arbitrary PHP code on the server. This vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and has a CVSS v3.1 score of 8.0, indicating high severity. No official patch or remediation information is currently available.

Successful exploitation allows a multisite subsite administrator to execute arbitrary PHP code on the server, potentially leading to full compromise of the affected WordPress installation, including confidentiality, integrity, and availability impacts. The attacker can bypass normal capability restrictions related to PHP file editing due to improper input escaping.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict multisite subsite administrator capabilities where possible and monitor for suspicious activity related to PHP file generation. Avoid granting multisite subsite administrator roles to untrusted users.