Stored PHP Code Injection in Create Block WordPress Plugin

Executive Summary

This vulnerability exists in the Create Block WordPress plugin before version 2.10.0. It fails to properly escape user-provided text when saving it to a PHP pattern file. This allows a multisite subsite administrator with limited privileges to inject malicious PHP code that can be executed on the server.

Useful 0 Not Useful 0

Detection Guidance

Check if the Create Block plugin version is below 2.10.0 using WordPress admin panel or run: wp plugin list | grep create_block in WP-CLI. Inspect generated PHP pattern files for unexpected PHP code snippets.

Useful 0 Not Useful 0

Impact Analysis

An attacker with multisite subsite admin access could exploit this to execute arbitrary PHP code on your server. This could lead to full system compromise, data theft, website defacement, or installation of backdoors for persistent access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information security. Both standards require proper access controls and data protection measures.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Create Block plugin to version 2.10.0 or later immediately. Remove any unauthorized PHP files in plugin directories. Review user roles with multisite subsite administrator privileges.

Useful 0 Not Useful 0