Live2DWebCanvas WordPress Plugin Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the Live2DWebCanvas plugin for WordPress, affecting all versions through 1.9.11. This issue arises from inadequate file path validation in the ClearFiles() function, enabling authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server. Such deletions could lead to remote code execution, particularly if critical files like wp-config.php are removed.

Impact

Exploitation of this vulnerability could result in unauthorized deletion of files on the server, with the potential for remote code execution if a sensitive file is deleted.

Remediation

Users are advised to update the Live2DWebCanvas plugin to version 1.9.12 or a newer patched version.