Arbitrary File Deletion Vulnerability in Live2DWebCanvas Plugin for WordPress

CVE-2024-13767

What is CVE-2024-13767?

The Live2DWebCanvas plugin for WordPress is susceptible to an arbitrary file deletion flaw due to inadequate file path validation within the ClearFiles() function. This vulnerability affects all versions up to and including 1.9.11 and can be exploited by authenticated users with Subscriber-level access or higher. Attackers can leverage this vulnerability to delete sensitive files on the server, potentially leading to unauthorized computer code execution when critical files like wp-config.php are targeted. Users should take immediate action to secure their installations to prevent exploitation.

References