{"id":"CVE-2026-92097","aliases":["EUVD-2026-100770","GHSA-4768-hg42-39c5"],"status":"published","title":"Click to Chat \u003c= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder","description":"The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.00525,"percentile":0.44754,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2026-10-14T01:27:15Z","modified":"2026-10-15T17:17:29Z","products":[{"vendor":"holithemes","product":"click to chat – holithemes"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf625e34-1f51-42a3-8daa-a5188dea226e?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/greetings-1.php#L22"},{"url":"https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/greetings-2.php#L18"},{"url":"https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/class-ht-ctc-chat-greetings.php#L111"},{"url":"https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.44/new/inc/greetings/class-ht-ctc-chat-greetings.php#L224"},{"url":"https://plugins.trac.wordpress.org/changeset/3716433/click-to-chat-for-whatsapp/trunk/new/inc/greetings/greetings-1.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92097"},{"url":"https://github.com/advisories/GHSA-4768-hg42-39c5"}],"sources":{"cve":[{"id":"CVE-2026-92097","title":"Click to Chat \u003c= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder","description":"The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.","status":"published","published":"2026-10-14T01:27:15.838Z","modified":"2026-10-15T16:43:51.033Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T13:48:24.536396Z"}],"euvd":[{"id":"EUVD-2026-100770","description":"The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.","status":"published","published":"2026-10-14T01:27:15Z","modified":"2026-10-15T16:43:51Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T17:00:11.901066Z"}],"ghsa":[{"id":"GHSA-4768-hg42-39c5","title":"The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode...","description":"The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.","status":"published","published":"2026-10-14T03:30:39Z","modified":"2026-10-14T03:30:47Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:13:22.867821Z"}],"nvd":[{"id":"CVE-2026-92097","description":"The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.","status":"published","published":"2026-10-14T02:17:01.397Z","modified":"2026-10-15T17:17:29.893Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:58.630796Z"}]}}