CVE-2024-6310: 
WordPress vulnerability analysis and mitigation

The Advanced AJAX Page Loader plugin for WordPress contains a Cross-Site Request Forgery vulnerability that enables Arbitrary File Upload in versions up to and including 2.7.7. The vulnerability exists due to missing nonce validation in the 'admininitAAPL' function and missing file type validation in the 'AAPLoptionsvalidate' function (NVD).

The vulnerability stems from two key security issues: 1) The absence of nonce validation in the 'admininitAAPL' function, and 2) Missing file type validation in the 'AAPLoptionsvalidate' function. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

This vulnerability allows unauthenticated attackers to upload arbitrary files to the affected site's server. If successfully exploited, this could lead to remote code execution if an attacker can trick a site administrator into performing specific actions, such as clicking on a malicious link (NVD).

Users should update to a version newer than 2.7.7 if available. If an immediate update is not possible, it is recommended to disable the Advanced AJAX Page Loader plugin until a patched version can be installed (NVD).