The Uncode WordPress theme contains an arbitrary file read vulnerability due to insufficient input validation in the 'uncode_admin_get_oembed' function affecting all versions up to 2.9.1.6. This vulnerability (CVE-2024-13681) allows unauthenticated remote attackers to read arbitrary files on the server, which can lead to disclosure of sensitive data. The CVSS 3.1 score of 7.5 reflects high severity with network attack vector, no privileges required, and no user interaction needed. No patch or official fix has been documented in the provided data.

Successful exploitation enables unauthenticated attackers to read arbitrary files on the server hosting the vulnerable Uncode theme, potentially exposing sensitive information such as configuration files, credentials, or other protected data. This can lead to further attacks or data breaches. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the Uncode theme if feasible, or restrict access to the vulnerable functionality through web application firewalls or other access controls to mitigate exposure.