9.1 CVSS: Click to Chat for WhatsApp v4.44 Lets Attackers Run Shortcodes Without Login
A critical vulnerability in the WordPress plugin allows remote attackers to execute arbitrary shortcodes without credentials, affecting versions up to 4.44.
Key points
- The flaw is rated 9.1 CVSS and allows unauthenticated code execution via shortcode injection.
- Versions 4.44 and earlier of the Click to Chat for WhatsApp plugin are affected.
- Attackers can exploit the issue on archive pages by manipulating the request URI.
The Click to Chat for WhatsApp plugin for WordPress contains a critical security flaw that allows unauthenticated attackers to execute arbitrary shortcodes. According to the National Vulnerability Database, versions up to and including 4.44 are vulnerable to this arbitrary shortcode execution issue.
The vulnerability stems from how the plugin handles URL data on archive pages. The greetings_dialog() function builds a template placeholder from the request URI, which is filtered by sanitize_text_field(). However, this data is then passed to do_shortcode() without stripping shortcode delimiters. This allows attacker-controlled bytes to reach the shortcode processor unfiltered.
Technical context
Because wp_kses() runs against main content before the URL substitution occurs, the safety check does not apply to the injected data. As a result, an attacker can execute any shortcode registered by WordPress core, the active theme, or other plugins. This weakness is classified as CWE-94, which relates to code injection flaws.
Affected systems
The issue specifically impacts the Click to Chat for WhatsApp plugin developed by HoliThemes. Any WordPress site running version 4.44 or any earlier version of this plugin is potentially exposed. The flaw does not require the attacker to have login credentials or user accounts on the site.
Defender's checklist
Site administrators should immediately audit their WordPress installations to identify if this plugin is active. Check the plugin version against the affected list provided by the vendor. Monitor server logs for unusual shortcode execution patterns or unexpected requests on archive pages. Verify that no unauthorized shortcodes have been executed recently.
Operational impact
Organizations should assess their reliance on third-party communication tools within their web infrastructure. Teams usually need to verify whether this plugin handles sensitive customer data or interacts with internal systems. Check whether the plugin’s functionality is critical to daily operations or if it can be temporarily disabled. IT leaders should inform web development teams about the potential for remote code execution. This ensures that risk owners understand the exposure level and can prioritize remediation efforts accordingly.
What to do and how to stay safe: Click to Chat for WhatsApp
- Review installed WordPress plugins and identify any running version 4.44 or older of Click to Chat for WhatsApp.
- Monitor web server access logs for suspicious requests targeting archive pages or containing shortcode patterns.
- Restrict access to administrative interfaces and ensure all user accounts use strong, unique passwords.
- Once the vendor provides an update, apply the patch immediately to resolve the arbitrary execution vulnerability.
Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction
General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-92097?
The National Vulnerability Database rates this vulnerability as critical with a CVSS score of 9.1.
Which versions of the plugin are affected?
All versions of the Click to Chat for WhatsApp plugin up to and including version 4.44 are affected.
Does an attacker need to log in to exploit this flaw?
No, the vulnerability allows unauthenticated attackers to execute arbitrary shortcodes without credentials.
