CVE-2025-39411 HIGH

CVE-2025-39411: WordPress WhatsApp Click to Chat Plugin for WordPress plugin <= 2.2.12 - Local File Inclusion vulnerability

Vendor Indie_Plugins
Product WhatsApp Click to Chat Plugin for WordPress
Weakness CWE-98 · PHP file inclusion
Published May 19, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Indie_Plugins WhatsApp Click to Chat Plugin for WordPress wpt-whatsapp.This issue affects WhatsApp Click to Chat Plugin for WordPress: from n/a through <= 2.2.12.

Explanation of Vulnerability in Simple Terms

02Summary

The WhatsApp Click to Chat plugin for WordPress versions 2.2.12 and earlier contains a vulnerability that allows an attacker to read sensitive data, modify site content, or disrupt service. The attack requires user interaction—typically clicking a malicious link—and network access, but no prior authentication. The vulnerability affects all installations of the plugin up to version 2.2.12.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify site content, or disrupt the site's availability by tricking a user into clicking a malicious link.

Potential impact on your site

04Site Impact

Any WordPress site running WhatsApp Click to Chat plugin ≤2.2.12 is at risk if users can be socially engineered to click attacker-controlled links.

Conditions required to exploit

05Prerequisites

An unauthenticated attacker must trick a site user into clicking a specially crafted link or visiting a malicious page.

Key dates

06Disclosure timeline

May 19, 2025 CVE published
April 28, 2026 Record updated