Arbitrary File Upload Vulnerability in Live2DWebCanvas Plugin for WordPress

CVE-2026-92895

What is CVE-2026-92895?

The Live2DWebCanvas plugin for WordPress contains a vulnerability that allows unauthenticated attackers to perform arbitrary file uploads. This weakness arises from inadequate validation of file extensions and MIME types in the download_one_file function, permitting attackers to upload potentially executable files. This issue is particularly concerning when the plugin's apiType setting is configured to custom-local mode, which, though not enabled by default and requiring a paid license, exposes sensitive REST nonce and session tokens on the front-end. Addressing this vulnerability is critical for securing installations of the affected plugin.

References