The Uncode WordPress theme suffers from an improper input validation vulnerability (CWE-20) in the 'uncode_recordMedia' function, present in all versions up to 2.9.1.6. This weakness permits authenticated attackers with low-level privileges (Subscriber and above) to perform arbitrary file reads on the hosting server. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability compromises confidentiality but not integrity or availability. No patch or official fix has been disclosed yet.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to read arbitrary files on the server, potentially exposing sensitive information. This compromises the confidentiality of server data but does not impact data integrity or system availability. The vulnerability could facilitate further attacks if sensitive configuration or credential files are disclosed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access where possible and monitor for suspicious activity related to file access. Avoid granting unnecessary privileges to low-level users. Follow updates from the vendor for patch availability.