{"id":"CVE-2024-6310","aliases":["EUVD-2024-47426","GHSA-m23h-9cwr-5gm4"],"status":"published","title":"Advanced AJAX Page Loader \u003c= 2.7.7 - Cross-Site Request Forgery to Arbitrary File Upload","description":"The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.7.7. This is due to missing nonce validation in the 'admin_init_AAPL' function and missing file type validation in the 'AAPL_options_validate' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00489,"percentile":0.4238,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2024-07-09T07:38:47Z","modified":"2026-06-17T08:17:45Z","products":[{"vendor":"advanced_ajax_page_loader_project","product":"advanced_ajax_page_loader"},{"vendor":"deano1987","product":"advanced ajax page loader"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccc75dee-1cf8-4fda-b2a1-f5d68e6c7887?source=cve","tags":["x_transferred"]},{"url":"https://plugins.trac.wordpress.org/browser/advanced-ajax-page-loader/tags/2.7.7/advanced-ajax-page-loader.php#L41","tags":["x_transferred"]},{"url":"https://plugins.trac.wordpress.org/browser/advanced-ajax-page-loader/tags/2.7.7/advanced-ajax-page-loader.php#L131","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6310"},{"url":"https://github.com/advisories/GHSA-m23h-9cwr-5gm4"}],"sources":{"cve":[{"id":"CVE-2024-6310","title":"Advanced AJAX Page Loader \u003c= 2.7.7 - Cross-Site Request Forgery to Arbitrary File Upload","description":"The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.7.7. This is due to missing nonce validation in the 'admin_init_AAPL' function and missing file type validation in the 'AAPL_options_validate' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","status":"published","published":"2024-07-09T07:38:47.893Z","modified":"2026-04-08T17:23:52.263Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:34:11.638716Z"}],"euvd":[{"id":"EUVD-2024-47426","description":"The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.7.7. This is due to missing nonce validation in the 'admin_init_AAPL' function and missing file type validation in the 'AAPL_options_validate' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","status":"published","published":"2024-07-09T07:38:47Z","modified":"2026-04-08T17:23:52Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:40.052372Z"}],"ghsa":[{"id":"GHSA-m23h-9cwr-5gm4","title":"The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to...","description":"The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.7.7. This is due to missing nonce validation in the 'admin_init_AAPL' function and missing file type validation in the 'AAPL_options_validate' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","status":"published","published":"2024-07-09T09:30:55Z","modified":"2026-04-08T21:33:56Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:07:22.142665Z"}],"nvd":[{"id":"CVE-2024-6310","description":"The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.7.7. This is due to missing nonce validation in the 'admin_init_AAPL' function and missing file type validation in the 'AAPL_options_validate' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","status":"published","published":"2024-07-09T08:15:11.733Z","modified":"2026-06-17T08:17:45.273Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:10:10.545705Z"}]}}