ScrollTo Top <= 1.2.2 - Cross-Site Request Forgery to Arbitrary File Upload

CVE-2024-6320

What is CVE-2024-6320?

The ScrollTo Top plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability, enabling unauthenticated attackers to upload arbitrary files to the server. This issue arises from the absence of nonce validation and inadequate file type validation within the 'options_page' function. By exploiting this vulnerability, an attacker may manage to execute remote code if they can deceive a site administrator into performing a specific action, such as clicking a crafted link. Immediate attention is required to implement robust security measures to mitigate the potential risks associated with this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References