Arbitrary File Read Vulnerability in Uncode Theme for WordPress

CVE-2024-13681

What is CVE-2024-13681?

The Uncode theme for WordPress exhibits a security flaw that allows unauthorized access to sensitive files on the server. This is due to a lack of adequate input validation in the 'uncode_admin_get_oembed' function, affecting all versions through 2.9.1.6. Attackers without authentication can exploit this vulnerability to read arbitrary files, leading to potential exposure of sensitive data.

References