CVE-2024-6320 is a CSRF vulnerability in the dwieeb ScrollTo Top WordPress plugin versions up to 1.2.2. The flaw arises from missing nonce validation and lack of file type checks in the 'options_page' function, enabling unauthenticated attackers to upload arbitrary files to the server. Successful exploitation requires tricking an administrator into executing a forged request, potentially leading to remote code execution. The vulnerability is rated with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No patch or official fix has been documented in the provided data.

An attacker can upload arbitrary files to the affected server without authentication by exploiting the CSRF vulnerability, potentially leading to remote code execution if an administrator is tricked into performing a malicious action. This compromises confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the critical nature of this impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links and consider disabling or removing the vulnerable plugin to prevent exploitation.