Live2DWebCanvas WordPress plugin arbitrary file upload allows remote code execution
Anyone can upload files to this website character plugin and hack it.
Summary
The Live2DWebCanvas WordPress plugin lets unauthenticated attackers upload files into its web-served directory. All versions up to and including 2.2.1 are affected, and remote code execution is possible under a specific setting.
Affected when
- apiType set to custom-local (self-hosted model mode)
- paid license in use
What to do
All versions up to and including 2.2.1 are affected. Check that you run a version newer than 2.2.1 and read the vendor's advisory.
Products and platforms
CVE IDs
Times
First published
First seen