{"id":"CVE-2026-92097","published":"2026-10-14T02:17:01.397","lastModified":"2026-10-15T17:17:29.893","description":"The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/class-ht-ctc-chat-greetings.php#L111","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/class-ht-ctc-chat-greetings.php#L224","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/greetings-1.php#L22","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/greetings-2.php#L18","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3716433/click-to-chat-for-whatsapp/trunk/new/inc/greetings/greetings-1.php","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf625e34-1f51-42a3-8daa-a5188dea226e?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Click to Chat for WhatsApp plugin allows unauthenticated attackers to execute arbitrary shortcodes through a vulnerability in how it processes URL placeholders in archive pages, potentially leading to remote code execution via shortcode execution.","exploitability":"Exploitation is straightforward with no special preconditions required, as attackers can simply craft a malicious URL that triggers the vulnerable greetings_dialog() function on archive pages.","blast_radius":"The impact could be significant across many WordPress sites using this plugin, potentially allowing attackers to execute arbitrary shortcodes and gain remote code execution capabilities.","remediation":"Upgrade to version 4.45 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","wordpress","shortcode","arbitrary-execution"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:57:17.337Z"}}