CVE-2026-92097 in Click to Chat Plugin
Summary
by MITRE • 10/14/2026
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The Click to Chat for WhatsApp plugin for WordPress contains a critical vulnerability in versions up to and including 4.44 that allows for Arbitrary Shortcode Execution. This flaw stems from an improper handling of user-supplied input within the greetings_dialog function, which is responsible for generating greeting messages displayed on archive pages. The core issue lies in how the application processes the URL structure provided by the client during a request to construct dynamic content. Specifically, the plugin attempts to sanitize the incoming REQUEST_URI server variable using the sanitize_text_field function before inserting it into a template placeholder labeled {url}. While this sanitization step removes certain dangerous characters such as HTML tags and script elements, it does not strip or escape shortcode delimiters like square brackets [ ]. Consequently, any maliciously crafted shortcodes embedded within the URL path remain intact after filtering.
The severity of this vulnerability is significantly amplified by the order in which security functions are applied relative to template substitution. The plugin executes wp_kses against the main_content variable prior to performing the {url} placeholder replacement. This sequencing error means that while other parts of the content may be sanitized, the attacker-controlled URL data bypasses these protections because it has not yet been injected into the string at the time wp_kses is called. Once the substitution occurs, the unsanitized shortcode syntax from the URL is passed directly to the do_shortcode function. This WordPress core function parses and executes any valid shortcodes found within its input, effectively granting an unauthenticated attacker the ability to run arbitrary code registered by the WordPress core itself, the active theme, or other installed plugins that expose executable shortcodes.
From a technical perspective, this vulnerability represents a classic case of insufficient validation leading to command injection via template processing mechanisms. The attack vector is remote and requires no authentication, allowing any internet user with knowledge of the target site structure to exploit it. By crafting specific URLs containing malicious shortcode payloads such as [wp_shell_exec cmd=whoami] or other dangerous functions exposed by third-party plugins, an attacker can achieve Remote Code Execution on the vulnerable server. This capability enables a wide range of adverse outcomes including complete compromise of the web application, theft of sensitive data stored within the WordPress database, defacement of the website, and potentially using the compromised host as part of a larger botnet or for further lateral movement within the network infrastructure.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) under the category of injection flaws where user input is directly executed without proper sanitization. In terms of the MITRE ATT&CK framework, this exploit maps to T1059 Command and Scripting Interpreter, specifically leveraging shortcodes as a mechanism for executing system commands or scripts. The lack of authentication requirement places it firmly within the initial access phase of an attack lifecycle, making it particularly dangerous against sites that do not require login credentials for public-facing pages such as blogs, news archives, or product listings.
Mitigation strategies must focus on immediate remediation and defensive coding practices. Administrators should update the Click to Chat for WhatsApp plugin to version 4.45 or later where this issue has been addressed by properly escaping shortcode delimiters before passing data to do_shortcode. In cases where updating is not immediately feasible, a temporary workaround involves implementing custom server-side rules via .htaccess or web application firewall configurations to block URLs containing square brackets if they are directed at the specific endpoint handling greeting dialogs. Furthermore, developers should adhere to secure coding standards by ensuring that all user-supplied data intended for execution contexts undergoes rigorous sanitization after any template substitutions have occurred. Utilizing wp_kses_post with appropriate allowed tags and attributes can help mitigate risks when rendering dynamic content derived from external sources. Regular security audits and penetration testing are recommended to identify similar patterns of improper input validation across the entire WordPress ecosystem.