Description
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.
References6
- plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/t…
- plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/t…
- plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/t…
- plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/t…
- plugins.trac.wordpress.org/changeset/3716433/click-to-chat-for-…
- www.wordfence.com/threat-intel/vulnerabilities/id/cf625e34-1f51…
Metrics
- CVSS 3.1
-
9.1
CRITICAL
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - EPSS — exploit probability
- 1% percentile: 45 · as of 11 November 2026
- CWE
- CWE-94
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.