Description

The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the download_one_file function. This is due to missing file extension whitelist and MIME type validation in download_one_file() when writing files derived from attacker-controlled manifest entries to the web-served plugin directory. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible when the plugin's apiType setting is configured as custom-local (self-hosted model mode), a non-default option that requires a paid license and prints the REST nonce and one-time session tokens into every front-end page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-11-06T12:17:24.820Z",
  "pubdate": "2026-11-06T12:17:24.820Z",
  "executiveSummary": "The Live2DWebCanvas plugin for WordPress, in versions up to and including 2.2.1, contains a critical arbitrary file upload vulnerability within the download_one_file function.\nThis vulnerability stems from a lack of server-side validation regarding file extensions and MIME types when processing manifest entries.\nSuccessful exploitation allows unauthenticated attackers to upload arbitrary files—including executable scripts—directly into the web-accessible plugin directory.\nThe vulnerability is most severe when the plugin is configured with the 'custom-local' apiType, as this configuration inadvertently exposes sensitive information such as REST nonces and one-time session tokens to the front-end.\nThe primary risk is Remote Code Execution (RCE), which could result in full site compromise, unauthorized data access, and persistent backdooring.\nExploitation requires no prior authentication, significantly increasing the risk profile for installations where the specific non-default configuration is active.",
  "technicalDetails": "The vulnerability exists within the download_one_file function of the Live2DWebCanvas WordPress plugin. The root cause is the insufficient sanitization and validation of input provided via manifest entries used to download remote files into the local filesystem.\nWhen processing these entries, the function fails to enforce a whitelist of permitted file extensions or verify the MIME type of the incoming stream before writing the file to the plugin's web-served directory. Consequently, an attacker can supply a malicious payload masquerading as a legitimate Live2D asset to achieve arbitrary file placement.\nThe attack flow begins with an unauthenticated attacker crafting a malicious manifest file containing references to an attacker-controlled remote server. By invoking the download_one_file function with these entries, the plugin is coerced into fetching and saving the malicious payload to a predictable location on the web server.\nThe impact is heavily dependent on the plugin's API configuration. When the 'apiType' setting is set to 'custom-local' (the self-hosted model mode), the plugin exposes critical security tokens, including REST nonces and one-time session tokens, directly within the front-end source code of every page. This information disclosure provides attackers with the necessary context to bypass subsequent security controls or facilitate further interaction with the WordPress REST API.\nOnce the malicious file is persisted on the web server, the attacker can trigger execution by directly requesting the file via a standard HTTP GET request. Given the file is uploaded into a directory reachable by the web server, the server will interpret or execute the uploaded script (e.g., PHP), leading to full Remote Code Execution (RCE) on the underlying host.\nBecause the function does not verify the identity of the requester, the vulnerability is exploitable by any unauthenticated remote attacker. The lack of strict extension checks bypasses common security mechanisms intended to prevent the upload of executable code. Post-exploitation impact typically involves complete server compromise, including the ability to manipulate the database, exfiltrate sensitive site data, or inject further malicious persistent code."
}