CVE-2024-6460 PoC — Grow by Tradedoubler <= 2.0.21 - Unauthenticated LFI

Source

https://github.com/Nxploited/CVE-2024-6460

Associated Vulnerability

Title:Grow by Tradedoubler <= 2.0.21 - Unauthenticated LFI (CVE-2024-6460)
Description:The Grow by Tradedoubler WordPress plugin through 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files.

Description

Grow by Tradedoubler < 2.0.22 - Unauthenticated LFI

Readme

# CVE-2024-6460
Grow by Tradedoubler &lt; 2.0.22 - Unauthenticated LFI

## Usage

   ```bash
usage: CVE-2024-6460.py [-h] -u URL -U USERNAME -P PASSWORD [-c COMPONENT]

Grow by Tradedoubler < 2.0.22 - Unauthenticated LFI

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     Target WordPress site URL (e.g., http://example.com)
  -U USERNAME, --username USERNAME
                        WordPress username
  -P PASSWORD, --password PASSWORD
                        WordPress password
  -c COMPONENT, --component COMPONENT
                        Path to the target file (default: wp-config.php)

File Snapshot


 [4.0K]  /data/pocs/680b1547845dc06b0bb60c5e4980ae284b9c7d83
├── [3.5K]  CVE-2024-6460.py
└── [ 631]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!