Create Block Theme
Monthly
PHP code injection in the Create Block Theme WordPress plugin (before 2.10.0) enables a multisite subsite administrator to execute arbitrary server-side code by exploiting insufficient output escaping when the plugin writes user-supplied text into generated PHP pattern files. The vulnerability leverages a capability boundary mismatch unique to WordPress multisite: subsite admins hold the capability gating pattern file generation but are denied the capability normally required for PHP file editing, creating an unintended privilege escalation path to full remote code execution. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile), indicating exploitation is currently targeted rather than widespread.
PHP code injection in the Create Block Theme WordPress plugin (before 2.10.0) enables a multisite subsite administrator to execute arbitrary server-side code by exploiting insufficient output escaping when the plugin writes user-supplied text into generated PHP pattern files. The vulnerability leverages a capability boundary mismatch unique to WordPress multisite: subsite admins hold the capability gating pattern file generation but are denied the capability normally required for PHP file editing, creating an unintended privilege escalation path to full remote code execution. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile), indicating exploitation is currently targeted rather than widespread.