CVE-2024-6310 is a CSRF vulnerability in the Advanced AJAX Page Loader plugin for WordPress (versions up to 2.7.7). The issue arises from missing nonce validation in the 'admin_init_AAPL' function and missing file type validation in the 'AAPL_options_validate' function. These flaws enable unauthenticated attackers to upload arbitrary files to the affected server by crafting a forged request that an administrator must execute. Successful exploitation could lead to remote code execution on the server hosting the vulnerable plugin.

An attacker can upload arbitrary files to the server without authentication by exploiting the CSRF vulnerability, potentially leading to remote code execution if an administrator is tricked into executing the malicious request. This compromises the confidentiality, integrity, and availability of the affected system, as reflected by the CVSS score of 8.8 (high severity).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should avoid clicking on untrusted links and consider disabling or removing the vulnerable plugin. Monitoring for updates from the vendor is recommended to apply an official fix once released.