CVE-2024-13773 is a vulnerability in the uxper Civi WordPress theme caused by the use of hard-coded cryptographic keys. This flaw exposes sensitive credentials embedded in the plugin code, specifically LinkedIn client and secret keys, to unauthenticated attackers. The vulnerability affects all versions up to and including 2.1.4. The CVSS 3.1 base score is 7.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts to confidentiality, integrity, and availability.

An attacker can extract hard-coded LinkedIn client and secret keys without authentication, potentially compromising integrations that rely on these credentials. This exposure can lead to unauthorized access or misuse of LinkedIn API services associated with the compromised keys. The vulnerability impacts confidentiality, integrity, and availability of the affected system's data and services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider removing or disabling the vulnerable plugin or restricting access to the plugin files to prevent unauthorized extraction of credentials. Monitor vendor channels for updates or patches addressing this issue.