Improper Control of Filename Vulnerability in WhatsApp Click to Chat Plugin by WordPress

CVE-2025-39411

What is CVE-2025-39411?

A vulnerability has been identified in the WhatsApp Click to Chat Plugin for WordPress, which arises from improper control of filenames within PHP Include/Require statements. This flaw could potentially allow an attacker to exploit the affected versions (up to 2.2.12) to include remote files, posing a serious risk to the integrity of the WordPress installation. Website administrators using this plugin should take immediate action to mitigate potential risks associated with this vulnerability.

References