Description
The Click to Chat – HoliThemes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.35. This makes it possible for authenticated attackers, with contributor access or above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Published: 2024-05-02
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-32417 The Click to Chat – HoliThemes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.35. This makes it possible for authenticated attackers, with contributor access or above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
References
Link Providers
https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/admin/admin_demo/class-ht-ctc-admin-demo.php#L280 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/inc/chat/class-ht-ctc-chat-shortcode.php#L207 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/inc/chat/class-ht-ctc-chat.php#L291 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/inc/group/class-ht-ctc-group-shortcode.php#L160 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/inc/group/class-ht-ctc-group.php#L118 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/inc/share/class-ht-ctc-share-shortcode.php#L181 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/inc/share/class-ht-ctc-share.php#L135 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/tools/woo/class-ht-ctc-woo.php#L284 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/prev/inc/class-ccw-shortcode.php#L277 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/prev/inc/commons/styles.php#L93 cve-icon cve-icon
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3072112%40click-to-chat-for-whatsapp%2Ftrunk&old=3064395%40click-to-chat-for-whatsapp%2Ftrunk&sfp_email=&sfph_mail= cve-icon cve-icon
https://www.wordfence.com/threat-intel/vulnerabilities/id/fe25bfef-34f0-4d57-9cba-9dcbf58281c6?source=cve cve-icon cve-icon
History

Fri, 10 Apr 2026 04:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 08 Apr 2026 18:30:00 +0000

Type Values Removed Values Added
Title Click to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File Inclusion
Weaknesses CWE-98

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:35:05.220Z

Reserved: 2024-04-15T18:28:54.742Z

Link: CVE-2024-3849

cve-icon Vulnrichment

Updated: 2024-08-01T20:26:56.921Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-05-02T17:15:31.563

Modified: 2026-04-08T19:21:28.480

Link: CVE-2024-3849

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses