The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Create Block Theme Plugin | — | Update create-block-theme plugin to version 2.10.0, or a newer patched version | Oct 30, 2026 | Jul 24, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub