CVE-2026-92097 holithemes CVE debrief

Who should care

Defenders responsible for WordPress installations with the Click to Chat for WhatsApp plugin should assess potential exposure and impact, focusing on affected operators, platforms, vulnerability management, and security teams. They should verify exposure, assess impact, and plan for updates or mitigations.

Why it matters

The Click to Chat for WhatsApp plugin vulnerability allows unauthenticated attackers to execute arbitrary shortcodes, potentially leading to data breaches or site compromise. Defenders should verify exposure and assess potential impact.

• Unauthenticated attackers can execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin.
• Defenders should verify exposure and assess potential impact.
• Arbitrary shortcode execution can lead to various consequences, including data breaches or site compromise.

Technical summary

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44. This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, as unauthenticated attackers can execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin.

Recommended defensive actions

• Verify exposure by checking if the Click to Chat for WhatsApp plugin is installed and if the version is 4.44 or earlier.
• Assess potential impact by evaluating the possible consequences of arbitrary shortcode execution.
• Consider updating the plugin to a version that addresses the vulnerability, if available.
• Monitor for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected versions and a technical description of the issue. Defenders should verify exposure and assess potential impact based on limited evidence from CVE and source item records. Evidence limits suggest focusing on CVE and source-provided details, with verification tasks to confirm affected scope.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.