CVE-2026-92895: Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter
The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the downloadonefile function. This is due to missing file extension whitelist and MIME type validation in downloadonefile() when writing files derived from attacker-controlled manifest entries to the web-served plugin directory. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible when the plugin's apiType setting is configured as custom-local (self-hosted model mode), a non-default option that requires a paid license and prints the REST nonce and one-time session tokens into every front-end page.
Event History
Frequently Asked Questions
Which deployments are exposed to remote code execution?
Remote code execution is possible when the plugin's apiType setting is configured as custom-local, the self-hosted model mode. This is a non-default configuration that requires a paid license.
Does an attacker need an account or user interaction?
No. The vulnerability can be exploited by an unauthenticated attacker and does not require user interaction. In custom-local mode, the plugin exposes the REST nonce and one-time session tokens in every front-end page.
What makes the file upload dangerous?
The affected download_one_file function writes files based on attacker-controlled manifest entries into a web-served plugin directory without a file-extension whitelist or MIME-type validation. Uploaded files may be executable, enabling code execution in the affected configuration.