Authenticated code execution via unsigned block attributes

Code injection in Cwicly 1.4.0.2 and earlier allows remote authenticated users with contributor access to execute code on the server. The cc_code_render_callback function in code.php passes a REST-rendered block's code attribute directly to PHP eval without proving that a trusted user created it. The WordPress rendered-blocks endpoint accepts attacker-controlled attributes without post sanitization, and the default Contributor role satisfies its edit_posts check.