Threats tagged 'ghsa-5xwf-2jpg-pxvv'

The Live2DWebCanvas WordPress plugin versions up to and including 2.2.1 contain an arbitrary file upload vulnerability via the download_one_file function. This flaw arises from missing file extension and MIME type validation, allowing unauthenticated attackers to upload potentially executable files. Remote code execution is possible if the plugin is configured with the non-default custom-local apiType setting, which requires a paid license and exposes REST nonce and session tokens on front-end pages.