Cyber & AI intelligence
Wasteland.
Briefs indexed3476
Issues33
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-92097 2026-10-14

Click to Chat for WhatsApp Plugin Lets Unauthenticated Attackers Run Arbitrary Shortcodes (CVE-2026-92097)

"A critical flaw (CVSS 9.1) in the Click to Chat for WhatsApp plugin for WordPress, versions up to and including 4.44, lets unauthenticated attackers run any registered shortcode through crafted request URLs."

A critical flaw (CVSS 9.1) in the Click to Chat for WhatsApp plugin for WordPress, versions up to and including 4.44, lets unauthenticated attackers run any registered shortcode through crafted request URLs.

What Is It

CVE-2026-92097 is an Arbitrary Shortcode Execution vulnerability, classified as CWE-94 (Code Injection). Wordfence reported it, and NVD published it on 2026-10-14.

The bug is in the plugin's greetings_dialog() function. On archive pages, the function fills the {url} template placeholder from $_SERVER['REQUEST_URI']. That value goes through sanitize_text_field() only. The greetings-1 and greetings-2 templates then pass the substituted greeting content to do_shortcode(), and shortcode delimiters are never stripped.

The plugin does run wp_kses() on main_content, but it runs before the {url} substitution. As a result, URL bytes controlled by the attacker reach do_shortcode() unfiltered.

Why It Matters

Unauthenticated attackers can execute arbitrary shortcodes registered by WordPress core, the active theme, or any other installed plugin. The real-world impact therefore depends on which shortcodes exist on a given site.

The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N: - Attack vector: network - Attack complexity: low - Privileges required: none - User interaction: none - Impact: high to confidentiality and integrity, none to availability

Exploitation status: This CVE has no entry in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not currently confirm active exploitation.

What's Vulnerable

The NVD record lists no CPEs. Its status is "Received," so NVD has not yet completed enrichment.

Patch Status

The source data names no fixed release version. The NVD references include a WordPress plugin repository changeset (3716433) that modifies greetings-1.php in the plugin's trunk, which indicates the developer has committed a code change.

Because the CVE is not in the KEV catalog, there is no CISA KEV required action or due date.

Administrators running version 4.44 or earlier should check the Wordfence advisory and the plugin repository for a release that includes the fix, then update once one is available.

Sources