CVE-2026-92097 - Arbitrary Shortcode Execution in Click to Chat for WhatsApp

The Click to Chat for WhatsApp plugin for WordPress versions 4.44 and earlier contains a vulnerability (CVE-2026-92097) that allows for unauthenticated arbitrary shortcode execution. The flaw exists within the greetings_dialog() function, which constructs the {url} template placeholder using the $_SERVER['REQUEST_URI'] variable. While this variable is filtered via sanitize_text_field(), the plugin fails to strip shortcode delimiters before passing the content to do_shortcode().

Crucially, the plugin applies wp_kses() to the content before performing the {url} substitution, meaning attacker-controlled malicious bytes are not neutralized by the security filter. By crafting a specific REQUEST_URI, an attacker can trigger any shortcode registered within the WordPress environment, including those defined by the theme or other installed plugins. This vulnerability can lead to unauthorized actions, data exfiltration, or potentially full remote code execution depending on the functionality of the available shortcodes within the target WordPress instance.

Impact

The vulnerability carries a CVSS 3.1 base score of 9.1, indicating a high potential for compromise. If successfully exploited, an unauthenticated attacker could execute arbitrary code or perform administrative actions within the context of the WordPress site. The number of impacted installations is significant, given the popularity of WordPress plugins for customer engagement, potentially exposing numerous websites to site takeover or unauthorized backend operations.

Recommendation

Prioritize the immediate update of the Click to Chat for WhatsApp plugin to a version addressing CVE-2026-92097. Detection engineering teams should monitor web server logs for suspicious characters in the URI that are associated with shortcode syntax, such as square brackets, that do not correspond to legitimate site navigation patterns.

• Update the Click to Chat for WhatsApp plugin to the latest available version containing the security patch for CVE-2026-92097.
• Implement Web Application Firewall (WAF) rules to inspect incoming URI requests for suspicious patterns, specifically looking for brackets '[' and ']' that may be used to initiate shortcode execution.
• Audit all active plugins for registered shortcodes that could be leveraged for elevated privileges or sensitive actions.