Click to Chat EUVD-2026-100770

Exploitation requires that the Click to Chat for WhatsApp greetings feature is active and configured to render on archive pages using the greetings-1 or greetings-2 templates, AND that the greeting content includes the {url} template placeholder (this is what carries the attacker-controlled $_SERVER['REQUEST_URI'] into do_shortcode()). The practical impact is further bounded by which shortcodes are registered by WordPress core, the active theme, or other installed plugins - a dangerous/abusable shortcode must be present for meaningful impact. No authentication or user interaction is required (PR:N/UI:N) and the request targets an archive page over the network, but the configuration dependency (non-default greeting setup emitting {url} on archive pages) is the key limiting factor defenders should check.

Multiple signals point to a genuinely high-severity flaw but with important real-world caveats. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.1 Critical) describes remote, unauthenticated, no-interaction code injection (CWE-94), which is a legitimate priority on its face. However, the described impact is 'arbitrary shortcode execution,' not guaranteed direct code execution - the actual severity hinges on which shortcodes are registered by core, the active theme, or other plugins on the target site, so C:H/I:H is a worst-case assumption rather than a universal outcome. Exploitation is also conditioned on site-side configuration (the greetings feature must emit the {url} placeholder on archive pages), which is beyond the attacker's control and tempers the AC:L rating. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was supplied, so no active-exploitation or mass-automation signal exists at this time. Net: a credible critical-class bug warranting prompt patching for affected sites, but the 'RCE' framing likely overstates the baseline impact, which is config- and shortcode-dependent.

An unauthenticated attacker requests an archive page (e.g., a category, tag, or date archive) with a crafted REQUEST_URI containing WordPress shortcode syntax. Because sanitize_text_field() does not strip shortcode delimiters and wp_kses() runs before the {url} substitution, the raw URL bytes are placed into the greeting content and passed to do_shortcode(), executing the injected shortcode. No public proof-of-concept was provided in the source data.