CVE-2026-92097: Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetingsdialog() function building the {url} template placeholder from a sanitizetextfield()-filtered $SERVER['REQUESTURI'] on archive pages and then passing the substituted greeting content to doshortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wpkses() runs against maincontent BEFORE the {url} substitution, the attacker-controlled URL bytes reach doshortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it by sending a crafted request to an affected WordPress site. No privileges or user interaction are required.
When is an affected site exposed?
Exposure occurs on archive pages when the plugin uses the greetings-1 or greetings-2 template. The attacker-controlled request URI is substituted into the {url} placeholder and then processed as shortcode content.
What determines the impact of shortcode execution?
The available impact depends on shortcodes registered by WordPress core, the active theme, or other installed plugins. An attacker can execute arbitrary shortcodes that are registered in that environment.
Are versions later than 4.44 confirmed vulnerable by the supplied information?
No. The provided data identifies versions up to and including 4.44 as vulnerable, but does not provide a fixed version or confirm the status of later releases.