{"id":"CVE-2026-92895","kind":"vulnerability","aliases":["CVE-2026-92895"],"related":[],"title":"WordPress Live2DWebCanvas plugin: unauthenticated file upload leads to code execution","description":"The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the download_one_file function. This is due to missing file extension whitelist and MIME type validation in download_one_file() when writing files derived from attacker-controlled manifest entries to the web-served plugin directory. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible when the plugin's apiType setting is configured as custom-local (self-hosted model mode), a non-default option that requires a paid license and prints the REST nonce and one-time session tokens into every front-end page.","summary":"The Live2DWebCanvas WordPress plugin up to and including 2.2.1 writes files from attacker-controlled manifest entries into its web-served directory without extension or MIME checks. An unauthenticated attacker can upload executable files, which may allow remote code execution when the non-default custom-local apiType mode is enabled.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["apitype-not-custom-local","plugin-above-2.2.1","plugin-not-installed"],"how_to_check":"- Check the installed Live2DWebCanvas plugin version in the WordPress admin plugin list or the plugin's main file header; `2.2.1` or earlier is affected.\n- Look at the plugin's apiType setting; the custom-local value is required for the code-execution path.\n- Look for unexpected executable files in the plugin directory under wp-content/plugins.","fix":"- Live2DWebCanvas plugin: move to a version later than `2.2.1`; the fixed version is not named in the sources.","status":"open","published_at":"2026-11-06T12:17:24+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","triaged_at":"2026-11-06T12:42:43+00:00","updated_at":"2026-11-06T12:42:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T12:42:43Z","model":"claude-haiku-5-5","output":{"fix":"- Live2DWebCanvas plugin: move to a version later than `2.2.1`; the fixed version is not named in the sources.","reach":"internet","title":"WordPress Live2DWebCanvas plugin: unauthenticated file upload leads to code execution","impact":"high","summary":"The Live2DWebCanvas WordPress plugin up to and including 2.2.1 writes files from attacker-controlled manifest entries into its web-served directory without extension or MIME checks. An unauthenticated attacker can upload executable files, which may allow remote code execution when the non-default custom-local apiType mode is enabled.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker uploads executable files and may run code on the server","analyst_note":"Confirm the fixed version after 2.2.1 and whether a patch exists in the WordPress plugin repository or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-92895.","how_to_check":"- Check the installed Live2DWebCanvas plugin version in the WordPress admin plugin list or the plugin's main file header; `2.2.1` or earlier is affected.\n- Look at the plugin's apiType setting; the custom-local value is required for the code-execution path.\n- Look for unexpected executable files in the plugin directory under wp-content/plugins.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-2.2.1","apiType-not-custom-local"],"who_is_affected":"Sites running the Live2DWebCanvas WordPress plugin at version 2.2.1 or earlier are exposed. The code-execution path needs the non-default custom-local apiType setting, which requires a paid license; sites without that setting enabled are less exposed, but the upload flaw itself is reachable without an account. Sites that do not run this plugin can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000806,"input_tokens":4352,"output_tokens":742,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-92895':13A,16A '2.2.1':33B,96C 'allow':62B 'apityp':74B,160C 'arbitrari':86C 'attack':38B,55B,125C,142C 'attacker-control':37B,124C 'check':52B 'code':9A,64B,153C 'configur':163C 'control':39B,126C 'custom':72B,166C 'custom-loc':71B,165C 'cve':11A,14A 'default':70B,176C 'deriv':122C 'directori':47B,135C 'download':99C,116C 'due':105C 'enabl':77B 'end':198C 'entri':41B,128C 'everi':195C 'execut':10A,58B,65B,149C,154C 'extens':49B,109C 'file':5A,35B,59B,87C,101C,108C,118C,121C,145C 'front':197C 'front-end':196C 'function':102C 'host':20B,170C 'includ':32B,95C 'lead':7A 'licens':182C 'live2dwebcanvas':2A,26B,79C 'local':73B,167C 'make':137C,151C 'manifest':40B,127C 'may':61B,147C 'mime':51B,112C 'miss':107C 'mode':75B,172C 'model':171C 'non':69B,175C 'non-default':68B,174C 'nonc':187C 'one':100C,117C,190C 'one-tim':189C 'option':177C 'packag':17B 'page':199C 'paid':181C 'plugin':3A,24B,28B,80C,134C,158C 'possibl':139C,155C 'print':184C 'remot':63B,152C 'requir':179C 'rest':186C 'self':19B,169C 'self-host':18B,168C 'serv':46B,133C 'session':192C 'set':161C 'time':191C 'token':193C 'type':113C 'unauthent':4A,54B,141C 'upload':6A,57B,88C,144C 'valid':114C 'version':91C 'via':97C 'vulner':84C 'web':45B,132C 'web-serv':44B,131C 'whitelist':110C 'without':48B 'wordpress':1A,21B,23B,27B,82C 'wordpress-plugin':22B 'write':34B,120C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Live2DWebCanvas WordPress plugin at version 2.2.1 or earlier are exposed. The code-execution path needs the non-default custom-local apiType setting, which requires a paid license; sites without that setting enabled are less exposed, but the upload flaw itself is reachable without an account. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-2026':12A,15A '-92895':13A,16A 'code':9A 'cve':11A,14A 'execut':10A 'file':5A 'lead':7A 'live2dwebcanvas':2A 'plugin':3A 'unauthent':4A 'upload':6A 'wordpress':1A","search_b":"'2.2.1':33B 'allow':62B 'apityp':74B 'attack':38B,55B 'attacker-control':37B 'check':52B 'code':64B 'control':39B 'custom':72B 'custom-loc':71B 'default':70B 'directori':47B 'enabl':77B 'entri':41B 'execut':58B,65B 'extens':49B 'file':35B,59B 'host':20B 'includ':32B 'live2dwebcanvas':26B 'local':73B 'manifest':40B 'may':61B 'mime':51B 'mode':75B 'non':69B 'non-default':68B 'packag':17B 'plugin':24B,28B 'remot':63B 'self':19B 'self-host':18B 'serv':46B 'unauthent':54B 'upload':57B 'web':45B 'web-serv':44B 'without':48B 'wordpress':21B,23B,27B 'wordpress-plugin':22B 'write':34B","search_c":"'2.2.1':96C 'apityp':160C 'arbitrari':86C 'attack':125C,142C 'attacker-control':124C 'code':153C 'configur':163C 'control':126C 'custom':166C 'custom-loc':165C 'default':176C 'deriv':122C 'directori':135C 'download':99C,116C 'due':105C 'end':198C 'entri':128C 'everi':195C 'execut':149C,154C 'extens':109C 'file':87C,101C,108C,118C,121C,145C 'front':197C 'front-end':196C 'function':102C 'host':170C 'includ':95C 'licens':182C 'live2dwebcanvas':79C 'local':167C 'make':137C,151C 'manifest':127C 'may':147C 'mime':112C 'miss':107C 'mode':172C 'model':171C 'non':175C 'non-default':174C 'nonc':187C 'one':100C,117C,190C 'one-tim':189C 'option':177C 'page':199C 'paid':181C 'plugin':80C,134C,158C 'possibl':139C,155C 'print':184C 'remot':152C 'requir':179C 'rest':186C 'self':169C 'self-host':168C 'serv':133C 'session':192C 'set':161C 'time':191C 'token':193C 'type':113C 'unauthent':141C 'upload':88C,144C 'valid':114C 'version':91C 'via':97C 'vulner':84C 'web':132C 'web-serv':131C 'whitelist':110C 'wordpress':82C 'write':120C","first_public_at":"2026-11-06T12:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92895","severity":null,"published_at":"2026-11-06T12:17:24+00:00","modified_at":"2026-11-06T12:17:24+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","fetched_at":"2026-11-06T12:41:49+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}