Advanced AJAX Page Loader <= 2.7.7 - Cross-Site Request Forgery to Arbitrary File Upload

CVE-2024-6310

Summary

The Advanced AJAX Page Loader plugin for WordPress is susceptible to vulnerabilities that allow unauthenticated attackers to exploit Cross-Site Request Forgery. Due to insufficient nonce validation in the 'admin_init_AAPL' function and inadequate file type validation in the 'AAPL_options_validate' function, attackers can upload files to the server. This flaw poses a significant security risk, as it enables malicious users to potentially execute arbitrary code if they can manipulate a site administrator into interacting with a crafted request.

References