CVE-2024-6460 — AI Deep Analysis Summary

🚨 **Essence**: Local File Inclusion (LFI) in 'Grow by Tradedoubler'. 💥 **Consequences**: Attackers include malicious files via the `component` parameter.…

🛡️ **Root Cause**: Unvalidated user input in the `component` parameter. 🔍 **Flaw**: The plugin fails to sanitize input before including files, allowing path traversal. 📂

📦 **Affected**: WordPress Plugin: **Grow by Tradedoubler**. 📅 **Versions**: **2.0.21 and earlier**. ⚠️

💀 **Attacker Actions**: 1. Read sensitive files (e.g., `wp-config.php`). 2. Execute arbitrary PHP code. 3. Gain **full control** of the server. 🔓

🔑 **Auth Status**: **Unauthenticated** (per PoC titles). ⚙️ **Config**: Requires valid WP credentials for some PoCs, but core LFI is often exploitable without login. High risk. 🎯

💣 **Public Exploits**: **YES**. 🔗 GitHub PoCs available (Nxploited, E1-Bot141). 🤖 Nuclei templates exist. Wild exploitation likely. 🚀

🔍 **Self-Check**: 1. Scan for plugin version < 2.0.22. 2. Use Nuclei template `CVE-2024-6460.yaml`. 3. Test `component` parameter for LFI. 🧪

🩹 **Fix**: Update to version **2.0.22 or later**. 📢 **Status**: Patch available. Official fix recommended immediately. ✅

🚧 **No Patch?**: 1. **Disable/Uninstall** the plugin. 2. Block access to `/wp-content/plugins/grow/` via WAF. 3. Restrict file inclusion functions in `php.ini`. 🛑

🔥 **Urgency**: **CRITICAL**. ⏰ **Priority**: **P1**. Unauthenticated LFI leading to RCE. Patch immediately to prevent server takeover. 🚨