Click to Chat for WhatsApp: CVE-2026-92097 in WordPress

What CVE-2026-92097 is and who it affects

The Click to Chat for WhatsApp plugin for WordPress is affected by an arbitrary shortcode execution flaw tracked as CVE-2026-92097. According to the National Vulnerability Database (NVD) of NIST, the issue affects all versions up to and including 4.44. The weakness is classified as CWE-94 (improper control of code generation) and carries a CVSS 3.1 score of 9.1, rated CRITICAL, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. In plain terms: it can be reached over the network, needs no credentials, requires no action from a victim and has a high impact on confidentiality and integrity.

The technical cause sits in the greetings feature. The greetings_dialog() function builds the {url} placeholder from $_SERVER['REQUEST_URI'] after passing it through sanitize_text_field(), and then sends the resulting greeting content to do_shortcode() in the greetings-1 and greetings-2 templates. Because wp_kses() runs against main_content before the {url} substitution, the attacker-controlled bytes in the URL reach do_shortcode() without shortcode delimiters being stripped. The result is that unauthenticated attackers can execute arbitrary shortcodes registered by WordPress core, the active theme or any other installed plugin.

Any WordPress site running the plugin at version 4.44 or below is in scope. That includes small business sites, online shops and corporate websites across Spain — Barcelona, Lleida, Tarragona, Girona and beyond — where the plugin is often installed simply to add a WhatsApp contact button and then forgotten.

Why it matters, even without confirmed exploitation

As of the NVD publication date, 14 October 2026, CVE-2026-92097 does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalogue, so there is no public record of it being exploited in real attacks and no federal remediation deadline attached to it. That is not a reason to relax. A CVSS 9.1 unauthenticated flaw in a widely deployed plugin is exactly the kind of entry point that automated scanners find within days of disclosure, and shortcode execution can be chained with other plugins to escalate into data theft, defacement or a full site takeover.

For a Spanish pyme or e-commerce business, the practical risks are familiar: customer data exposed, which triggers GDPR notification duties; a shop taken offline during peak trading; or a compromised site used as a staging point to attack suppliers and clients. Small IT teams rarely have the capacity to track plugin advisories week after week, which is precisely how a plugin installed for a contact button ends up as the weakest link.

What to do today

• Check whether the plugin is installed and which version is running. In the WordPress dashboard, open the plugins list and confirm the version number of Click to Chat for WhatsApp. If it is 4.44 or lower, it is affected.
• Apply the fix indicated in the vendor's advisory. The NVD entry does not state which release corrects the flaw, so follow the official Click to Chat for WhatsApp security notice and update to whatever version the vendor indicates. If no fixed version is available yet, consider deactivating the plugin until one is published.
• Look for signs of intrusion. Review web server and application logs for unusual requests to archive pages with suspicious query strings or encoded shortcode syntax, check for unexpected administrative users, unfamiliar scheduled tasks and modified theme or plugin files.
• Reduce what is exposed to the internet. Remove plugins and themes that are not in use, restrict access to wp-admin and wp-login.php by IP or behind a VPN where possible, and keep WordPress core, themes and plugins on a controlled update cycle.

None of these steps is complicated on its own. The difficulty is doing them consistently, on every site, before someone else finds the gap.

How a cybersecurity team like ALMC's can help

At ALMC we work with pymes, online shops and companies across Catalonia that run WordPress, PrestaShop or Joomla and do not have a dedicated security department. Our approach is to find and close vulnerabilities before they are exploited: security audits and pentesting, server hardening, monitoring and incident response, and ongoing maintenance and updating of WordPress, PrestaShop and Joomla installations.

When a site has already been compromised, we also handle the recovery — cleaning a hacked website, removing backdoors and restoring normal operation. In cases like CVE-2026-92097, the work is less about reacting to a headline and more about knowing, site by site, which components are installed, which versions they run and which advisories apply. That inventory, kept current, is what turns a critical CVE from an emergency into a routine patch.

Related

• Abuse Shield

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.