CVE-2026-92097: WordPress Click to Chat Plugin RCE Flaw

CVE-2026-92097 Overview

CVE-2026-92097 is an arbitrary shortcode execution vulnerability affecting the Click to Chat for WhatsApp plugin for WordPress through version 4.44. The flaw resides in the greetings_dialog() function, which constructs the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages. The resulting content is passed to do_shortcode() in the greetings-1 and greetings-2 templates without stripping shortcode delimiters. Unauthenticated attackers can execute shortcodes registered by WordPress core, the active theme, or any installed plugin by crafting a malicious request URI.

Critical Impact
Unauthenticated remote attackers can execute arbitrary WordPress shortcodes, enabling data disclosure, content manipulation, and potential chaining into higher-impact attacks depending on the shortcodes available on the target site.

Affected Products

Click to Chat for WhatsApp plugin for WordPress
All versions up to and including 4.44
WordPress sites with archive pages where the plugin greetings feature is enabled

Discovery Timeline

2026-10-14 - CVE-2026-92097 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-92097

Vulnerability Analysis

The vulnerability is classified under CWE-94: Improper Control of Generation of Code. The Click to Chat for WhatsApp plugin provides a greetings dialog feature that supports template placeholders, including {url}, which is replaced with the current page URL. On archive pages, the plugin derives this value from the raw request URI and injects it into greeting markup that is subsequently processed by do_shortcode().

Because wp_kses() runs against the main_content variable before the {url} substitution occurs, the sanitization pass never sees the attacker-controlled bytes. The URL content reaches do_shortcode() with shortcode delimiters intact, allowing arbitrary shortcode invocation.

Root Cause

The root cause is incorrect ordering of sanitization operations in the class-ht-ctc-chat-greetings.php template rendering logic. sanitize_text_field() strips tags and control characters but preserves square brackets. When the sanitized URI is substituted into greeting content after wp_kses() has executed, no filter prevents shortcode delimiters such as [ and ] from reaching the shortcode parser.

Attack Vector

An unauthenticated attacker crafts a request to an archive page (category, tag, author, or date archive) with a URI containing shortcode syntax. When the greetings dialog renders, the {url} placeholder is replaced with the attacker's payload, and do_shortcode() executes any shortcodes present. The impact depends on which shortcodes are registered on the target site, including those from WordPress core, the active theme, or third-party plugins. For code-level context, see the vulnerable rendering in class-ht-ctc-chat-greetings.php line 111 and the template files greetings-1.php and greetings-2.php.

Detection Methods for CVE-2026-92097

Indicators of Compromise

HTTP request URIs to archive pages containing shortcode delimiter characters ([, ]) or percent-encoded equivalents (%5B, %5D)
Access log entries targeting category, tag, author, or date archive URLs with suspicious bracketed payloads
Unexpected plugin or theme shortcode output appearing on archive pages
Outbound requests or file reads triggered by shortcodes that would not normally fire on archive routes

Detection Strategies

Inspect web server access logs for archive-page requests containing square brackets or their URL-encoded forms in the request URI
Correlate anomalous shortcode execution events with the originating request URI in WordPress debug logs
Flag any installed version of Click to Chat for WhatsApp at or below 4.44 during routine plugin inventory scans

Monitoring Recommendations

Enable WordPress debug logging and forward wp-content/debug.log to a central log store for review
Monitor web application firewall (WAF) telemetry for requests to /category/, /tag/, /author/, and date-based archives containing shortcode syntax
Track changes to plugin files under wp-content/plugins/click-to-chat-for-whatsapp/ to confirm patch application

How to Mitigate CVE-2026-92097

Immediate Actions Required

Update the Click to Chat for WhatsApp plugin to the version released in changeset 3716433 or later
Audit all registered shortcodes on affected sites to identify any that perform sensitive actions or data retrieval
Review access logs for prior exploitation attempts targeting archive pages with bracketed URIs

Patch Information

The vendor addressed the vulnerability in the plugin update tracked by WordPress Plugin Changeset 3716433. The fix adjusts the greetings template rendering to prevent shortcode delimiters in the substituted {url} value from reaching do_shortcode(). Additional analysis is available in the Wordfence Vulnerability Analysis.

Workarounds

Disable the Click to Chat for WhatsApp plugin until the patched version is deployed
Disable the greetings dialog feature within the plugin settings if available
Configure WAF rules to block requests to archive page paths containing [ or %5B characters in the URI
Restrict access to archive pages to authenticated users where business requirements allow

bash

# Example WAF rule concept to block shortcode syntax in archive URIs
# ModSecurity rule skeleton
SecRule REQUEST_URI "@rx (?:/category/|/tag/|/author/|/\d{4}/).*(?:\[|%5B)" \
    "id:1092097,phase:1,deny,status:403,msg:'CVE-2026-92097 shortcode delimiter in archive URI'"