ScrollTo Top <= 1.2.2 - Cross-Site Request Forgery to Arbitrary File Upload

CVE-2024-6320

Summary

The ScrollTo Top plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability, enabling unauthenticated attackers to upload arbitrary files to the server. This issue arises from the absence of nonce validation and inadequate file type validation within the 'options_page' function. By exploiting this vulnerability, an attacker may manage to execute remote code if they can deceive a site administrator into performing a specific action, such as clicking a crafted link. Immediate attention is required to implement robust security measures to mitigate the potential risks associated with this vulnerability.

References