CVE-2026-92097

Deferred Deferred - Pending Action

Arbitrary Shortcode Execution in Click to Chat for WhatsApp WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Wordfence

Description

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92097

EUVD

EUVD-2026-100770

Affected Vendors & Products

Vendor	Product	Version / Range
holithemes	Click	to Chat – HoliThemes 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

The Click to Chat for WhatsApp WordPress plugin up to version 4.44 has an arbitrary shortcode execution flaw. The vulnerability occurs because the greetings_dialog() function uses a sanitized but attacker-controlled URL from the request URI on archive pages. This URL is inserted into a template and passed to do_shortcode() without removing shortcode delimiters. Since wp_kses() filters content before URL substitution, malicious shortcodes can be executed by unauthenticated attackers.

Detection Guidance

Check for the presence of the Click to Chat for WhatsApp plugin versions up to 4.44. Inspect WordPress logs for unusual shortcode execution patterns or unauthorized actions. Use security plugins like Wordfence to scan for known indicators of compromise.

Impact Analysis

Unauthenticated attackers could exploit this to execute arbitrary shortcodes on your WordPress site. This may allow them to perform actions like creating admin accounts, injecting malicious scripts, or stealing sensitive data. The high CVSS score (9.1) indicates severe potential impact including code execution and data compromise.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face fines, legal action, and reputational damage if exploited.

Mitigation Strategies

Update the Click to Chat for WhatsApp plugin to the latest version. Disable the plugin temporarily if an update is not immediately available. Review and restrict user permissions to prevent unauthorized shortcode execution.

Hi! I’m here to help you understand CVE-2026-92097. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70