CVE-2024-13767: Live2DWebCanvas Plugin File Deletion Flaw

CVE-2024-13767 is an arbitrary file deletion vulnerability in the Live2DWebCanvas WordPress plugin affecting versions up to 1.9.11. Authenticated attackers can delete critical files leading to remote code execution. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2024-13767 Overview

CVE-2024-13767 is an arbitrary file deletion vulnerability in the Live2DWebCanvas plugin for WordPress. The flaw exists in the ClearFiles() function, which fails to properly validate user-supplied file paths. Authenticated attackers with Subscriber-level access or above can delete arbitrary files on the underlying server. Deleting sensitive files such as wp-config.php can trigger the WordPress setup flow and enable remote code execution. All versions up to and including 1.9.11 are affected. The weakness is classified as Missing Authorization [CWE-862].

Critical Impact
Low-privileged users can delete arbitrary server files, leading to site takeover and remote code execution when wp-config.php is removed.

Affected Products

Live2DWebCanvas plugin for WordPress
All versions through 1.9.11
WordPress sites permitting Subscriber-level registration

Discovery Timeline

2025-01-31 - CVE-2024-13767 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13767

Vulnerability Analysis

The Live2DWebCanvas plugin exposes a ClearFiles() function intended to remove plugin-managed files. The function does not enforce sufficient authorization checks and does not validate that supplied file paths reside within the plugin's expected directory. An authenticated user with Subscriber privileges or higher can invoke this handler and pass a path targeting any file the web server user can access.

When an attacker deletes wp-config.php, WordPress treats the installation as uninitialized. The attacker can then reinstall WordPress against a database they control, gaining administrative access and achieving remote code execution through plugin or theme upload.

The issue combines Missing Authorization [CWE-862] with path traversal characteristics. Because Subscriber-level accounts can be self-registered on many WordPress sites, the effective attack surface is broad.

Root Cause

The ClearFiles() function lacks two required controls: a capability check restricting invocation to trusted administrators, and file path canonicalization confining deletions to the plugin's storage directory. Without these controls, unsanitized input flows directly into filesystem delete operations.

Attack Vector

Exploitation requires network access to the target WordPress instance and a valid Subscriber account. The attacker sends an authenticated request to the vulnerable AJAX or admin endpoint exposing ClearFiles(), supplying a target file path. The plugin removes the referenced file. A follow-up request to wp-admin/install.php enables full takeover after wp-config.php deletion. Refer to the Wordfence Vulnerability Report for endpoint specifics.

Detection Methods for CVE-2024-13767

Indicators of Compromise

Unexpected deletion of wp-config.php, .htaccess, or core WordPress files
Presence of a fresh WordPress installation screen at wp-admin/install.php on a previously configured site
Authenticated POST requests from Subscriber accounts to Live2DWebCanvas plugin endpoints referencing ClearFiles
New administrator accounts created shortly after suspicious plugin requests

Detection Strategies

Monitor web server access logs for requests to admin-ajax.php or plugin PHP files invoking Live2D actions from low-privileged sessions
Alert on filesystem delete events targeting WordPress root files outside normal maintenance windows
Compare file integrity baselines of the WordPress installation against current state on a scheduled basis

Monitoring Recommendations

Enable WordPress audit logging to capture user registration, role changes, and plugin activity
Forward web server and PHP error logs to a centralized analytics platform for correlation
Track outbound database connections from the WordPress host to detect installer re-configuration to attacker-controlled databases

How to Mitigate CVE-2024-13767

Immediate Actions Required

Deactivate the Live2DWebCanvas plugin until a patched release is confirmed installed
Disable open user registration or restrict the default role to a non-Subscriber capability set where feasible
Audit existing Subscriber and higher-level accounts for unfamiliar users and remove suspicious ones
Restore wp-config.php and other WordPress files from a known-good backup if deletion is detected

Patch Information

Review the WordPress Plugin Changeset for the code changes addressing the missing authorization and path validation in ClearFiles(). Update to the latest release available on the Live 2D Plugin Overview page, verifying the version is greater than 1.9.11.

Workarounds

Remove the plugin entirely if a patched version is not yet available
Apply a web application firewall rule blocking requests to the vulnerable endpoint from non-administrator sessions
Set filesystem permissions so the web server user cannot delete wp-config.php and other critical files

bash

# Configuration example
# Restrict write and delete permissions on critical WordPress files
chown root:www-data /var/www/html/wp-config.php
chmod 640 /var/www/html/wp-config.php
chattr +i /var/www/html/wp-config.php