Create Block Theme <= 2.10.1 - Authenticated (Author+) PHP Code Injection via Theme Export
- ID
- WPSEC-2026-0343
- Plugin
- Create Block Theme (create-block-theme)
- Affected
- all versions before 2.10.2
- Remediation
- Update to 2.10.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-94
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Create Block Theme on WPSec AttackSurface
- Fix released
- Published
Description
The Create Block Theme plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.10.1. When patterns are saved to the theme with text localization enabled, text and HTML attribute values are HTML-decoded after they have been escaped for the generated single-quoted PHP strings, so an encoded apostrophe such as ''' breaks out of the string. In addition, the removal of PHP open tags from pattern content runs only once, so nested sequences such as '<<??' leave a working '<?' tag, and non-localized block attributes are re-encoded without escaping '<'. This makes it possible for authenticated attackers with author-level access and above to place crafted content in a synced pattern that injects PHP code into the pattern files written when an administrator saves the patterns to the theme, leading to code execution on the server. The nested-tag and block-attribute variants require the unfiltered_html capability (editors and above on single-site installations).
References
- https://wpsec.com/vuln/WPSEC-2026-0343/
- https://plugins.svn.wordpress.org/create-block-theme/tags/2.10.2/
- https://wordpress.org/plugins/create-block-theme/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS