Creative players with any op permission level can execute all commands with required op level up to (including) 2

The bug

The following is based on a decompiled version of Minecraft 1.9 using MCP 9.24 beta.

The methods net.minecraft.item.ItemBlock.setTileEntityNBT(World, EntityPlayer, BlockPos, ItemStack) and net.minecraft.item.ItemMonsterPlacer.func_185079_a(World, EntityPlayer, ItemStack, Entity) both test only if a player using an item has an entry in the ops.json file. This means that a player with for example an op permission level of 0 can place a command block that contains a command which requires op permission level up to (including) 2.