{"id":"CVE-2026-92097","state":"PUBLISHED","title":"Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder","description":"The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.","publishedAt":"2026-10-14T01:27:15.838Z","updatedAt":"2026-10-15T16:43:51.033Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"Wordfence"},"assigner":"Wordfence","products":["holithemes Click to Chat – HoliThemes"],"affected":[{"vendor":"holithemes","product":"Click to Chat – HoliThemes","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.44","versionType":"semver"}]}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/cf625e34-1f51-42a3-8daa-a5188dea226e?source=cve","https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/greetings-1.php#L22","https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/greetings-2.php#L18","https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/class-ht-ctc-chat-greetings.php#L111","https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/class-ht-ctc-chat-greetings.php#L224","https://plugins.trac.wordpress.org/changeset/3716433/click-to-chat-for-whatsapp/trunk/new/inc/greetings/greetings-1.php"],"weaknesses":["CWE-94"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/92xxx/CVE-2026-92097.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-92097","state":"PUBLISHED","datePublished":"2026-10-14T01:27:15.838Z","dateUpdated":"2026-10-15T16:43:51.033Z","assignerShortName":"Wordfence","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","dateReserved":"2026-09-15T15:07:48.754Z"},"containers":{"cna":{"title":"Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder","descriptions":[{"lang":"en","value":"The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e."}],"affected":[{"vendor":"holithemes","product":"Click to Chat – HoliThemes","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.44","versionType":"semver"}]}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf625e34-1f51-42a3-8daa-a5188dea226e?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/greetings-1.php#L22"},{"url":"https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/greetings-2.php#L18"},{"url":"https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/class-ht-ctc-chat-greetings.php#L111"},{"url":"https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/class-ht-ctc-chat-greetings.php#L224"},{"url":"https://plugins.trac.wordpress.org/changeset/3716433/click-to-chat-for-whatsapp/trunk/new/inc/greetings/greetings-1.php"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","lang":"en","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"Wordfence","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","dateUpdated":"2026-10-14T01:27:15.838Z"},"credits":[{"lang":"en","type":"finder","value":"Kuba"}],"timeline":[{"time":"2026-09-15T15:19:57.000Z","lang":"en","value":"Vendor Notified"},{"time":"2026-10-13T12:25:30.000Z","lang":"en","value":"Disclosed"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-92097","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T10:53:07.319833Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T16:43:51.033Z"}}]}}}