CVE-2024-13691

Summary

CVE-2024-13691 is a vulnerability affecting the Uncode theme for WordPress. The issue lies in the 'uncode_recordMedia' function, which is found to be insufficiently validating user input. This defect allows authenticated attackers, even those with Subscriber-level access or higher, to arbitrarily read files on the server. Consequences can range from data exposure to potential server compromise. To mitigate the risk, WordPress users employing the Uncode theme are urged to upgrade to the latest version as soon as possible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.