Executive Summary

A critical vulnerability, CVE-2026-92097, with a CVSS score of 9.1, has been identified in the Click to Chat for WhatsApp WordPress plugin, affecting versions up to and including 4.44. This vulnerability allows unauthenticated attackers to execute arbitrary shortcodes, potentially leading to code execution and data breaches. The vulnerability is due to the improper handling of user-controlled URL bytes in the greetings_dialog() function.

Technical Analysis

The vulnerability class of CVE-2026-92097 is Arbitrary Shortcode Execution. The attack vector involves an unauthenticated attacker manipulating the REQUEST_URI server variable to inject malicious content, which is then passed to the do_shortcode() function without proper filtering. The root cause is the inadequate sanitization of user-controlled input and the failure to strip shortcode delimiters.

How It Gets Exploited

An unauthenticated remote attacker sends a crafted request to a WordPress site with the vulnerable plugin installed. Specifically, the attacker manipulates the REQUEST_URI server variable to inject malicious shortcode content. This content is then processed by the greetings_dialog() function, which builds a template placeholder from the unsanitized REQUEST_URI. The substituted greeting content is passed to do_shortcode() in the greetings-1 and greetings-2 templates without stripping shortcode delimiters. As a result, the attacker-controlled URL bytes reach do_shortcode() unfiltered, allowing the execution of arbitrary shortcodes registered by WordPress core, the active theme, or other plugins.

Impact Assessment

The Click to Chat for WhatsApp plugin, versions up to and including 4.44, is affected. An attacker could achieve arbitrary shortcode execution, potentially leading to code execution, data exfiltration, or privilege escalation. The CVSS score of 9.1 indicates a critical severity level, with high impacts on confidentiality and integrity.

Recommended Actions

Update the Click to Chat for WhatsApp plugin to a version later than 4.44. Specifically, update to version 4.45 or later, which should include the necessary patches to prevent arbitrary shortcode execution. Monitor your WordPress installations for any suspicious activity related to shortcode execution.

Sources

  • National Vulnerability Database (NVD)
  • Wordfence