CVE-2026-92895

The Live2DWebCanvas plugin for WordPress (versions up to and including 2.2.1 ) is vulnerable to Unauthenticated Arbitrary File Upload via the download_one_file function. The root cause is a lack of file extension whitelisting and MIME type validation when writing files from attacker-controlled ma...