The Live2DWebCanvas WordPress plugin allows unauthenticated attackers to upload arbitrary files because the download_one_file function does not validate file extensions or MIME types. This flaw (CWE‑434) lets an attacker place potentially executable files in a web‑served directory, which can lead to remote code execution when the plugin operates in custom‑local mode, a paid option that injects sensitive tokens into front‑end pages.

All installations of jiangweifang:Live2DWebCanvas with version numbers up to and including 2.2.1 are vulnerable. This includes every WordPress site that has the plugin installed in any configuration, regardless of user roles.

The CVSS score of 8.1 indicates a high severity impact. Although the EPSS score is not available, the lack of authentication requirements and the straightforward upload process suggest a meaningful exploitation probability for threats with enough site access. The vulnerability is not listed in CISA’s KEV catalog, but the potential for arbitrary code execution on a public IT system makes it a priority for mitigation.