CVE-2024-13767 is a missing authorization vulnerability (CWE-862) in the Live2DWebCanvas WordPress plugin, affecting all versions up to 1.9.11. The ClearFiles() function does not properly validate file paths or enforce authorization, enabling authenticated users with low privileges (Subscriber-level and above) to delete arbitrary files on the server. This can escalate to remote code execution if key files such as wp-config.php are deleted. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low attack complexity, required privileges at the low level, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impact.

An attacker with Subscriber-level access can delete arbitrary files on the server hosting the WordPress site. This can disrupt site availability and integrity, and potentially lead to remote code execution if critical files are deleted. The vulnerability does not directly impact confidentiality but poses a high risk to site integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and consider disabling or removing the Live2DWebCanvas plugin if possible to prevent exploitation.