CVE-2024-6321 is a CSRF vulnerability in the dwieeb ScrollTo Bottom WordPress plugin, affecting versions up to 1.1.1. The vulnerability arises from missing nonce validation and absent file type validation in the 'options_page' function, enabling unauthenticated attackers to upload arbitrary files via forged requests. Exploitation depends on social engineering to induce a privileged user to trigger the malicious request. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

An attacker can upload arbitrary files to the server hosting the vulnerable WordPress plugin without authentication, potentially leading to remote code execution if the uploaded files are executed by the server. This compromises the confidentiality, integrity, and availability of the affected system. The attack requires user interaction from a site administrator, such as clicking a crafted link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or removing the vulnerable plugin to prevent exploitation. Additionally, limiting administrative user exposure to untrusted content and monitoring for suspicious file uploads may reduce risk.