The Click to Chat for WhatsApp plugin is vulnerable in version 4.44 and earlier, allowing an attacker to trigger arbitrary shortcode execution through a crafted REQUEST_URI value. The vulnerability arises because the plugin substitutes an unfiltered {url} placeholder into greeting templates and then passes the resulting content to do_shortcode() without removing shortcode delimiters. This flaw permits unauthenticated users to execute any shortcode registered by WordPress core, the active theme, or other plugins, potentially leading to remote code execution.

WordPress sites that use HoliThemes’ Click to Chat – HoliThemes plugin version 4.44 or older are impacted. The issue exists within the greetings_dialog() function and the greetings-1.php and greetings-2.php templates. No other components of the plugin or WordPress core are affected.

The CVSS base score of 9.1 categorises this flaw as Critical, and the EPSS indicator of less than 1% suggests limited observed exploitation. The vulnerability is not listed in the CISA KEV catalogue. An attacker does not require authentication and only needs to request an archive page that renders the greetings_dialog() placeholder, which is a likely scenario on most public WordPress sites. Because the payload is delivered via do_shortcode(), an attacker could run PHP code, read or modify site data, or perform other malicious actions with the permissions of the running WordPress process.