The Back To Top WordPress plugin up to version 2.0 contains a Cross‑Site Request Forgery flaw that permits an attacker to trick a logged‑in user into performing actions on the site. The flaw is present in the backtotop component and can be triggered when an external site submits a request that inherits the victim’s authentication cookies. If an attacker controls the target action, they could modify site content, change settings, or trigger undesired operations, thereby compromising the integrity of the site.

WordPress sites running the Back To Top plugin version 2.0 or earlier, specifically the product listed by the CNA as arkapravamajumder Back To Top.

This vulnerability is scored with a CVSS of 4.3 and an EPSS below 1%, indicating a moderate severity but low exploitation probability. It is not currently listed in the CISA KEV catalog. The attack vector is presumed to be network‑based, requiring the victim to be logged in and a third‑party page to be viewed. Because CSRF relies on user credentials, the risk is limited to authenticated users but could have significant impact on the affected site’s integrity.