An improper control of code generation vulnerability in the Create Block Theme WordPress plugin could allow an authenticated administrator to perform malicious code injection.

The plugin fails to correctly sanitize inputs during theme generation, leading to a Code Injection vulnerability (CWE-94). The attack vector requires high privileges (PR:H), meaning an attacker must already be authenticated as an administrator to trigger the flaw.

Exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the server, potentially leading to full site compromise. While the CVSS score is 8.0, the requirement for high-level administrative access serves as a significant barrier for external attackers, though it remains a critical risk for insider threats or compromised admin accounts.

Immediate Action: Update the Create Block Theme plugin to version 2.10.0 or later to patch the code injection mechanism.

Proactive Monitoring: Monitor server-side file system changes and audit administrative user activity for any unauthorized theme or code modifications.

Compensating Controls: Enforce strict file system permissions and ensure that administrative accounts are secured with multi-factor authentication to prevent the initial access required for this exploit.

Public Exploit Available: No (exploit_available: false)

Although the vulnerability requires administrative access, the potential for total system compromise makes this a high-priority update. Organizations should apply the patch immediately and audit all administrative accounts for signs of unauthorized activity.