CVE-2024-13681
📋 TL;DR
The Uncode WordPress theme contains an arbitrary file read vulnerability that allows unauthenticated attackers to read any file on the server. This affects all WordPress sites using Uncode theme versions up to 2.9.1.6. Attackers can potentially access sensitive configuration files, credentials, and other critical system data.
💻 Affected Systems
- Uncode WordPress Theme
📦 What is this software?
Uncode by Undsgn
⚠️ Risk & Real-World Impact
Worst Case
Attackers read sensitive files like wp-config.php containing database credentials, server configuration files, or other sensitive data leading to complete site compromise.
Likely Case
Attackers exfiltrate configuration files, source code, or other sensitive information that could enable further attacks.
If Mitigated
Attackers can only read non-sensitive files or access is blocked by proper file permissions and web server restrictions.
🎯 Exploit Status
Exploitation requires sending specially crafted requests to the vulnerable endpoint. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.1.7 or later
Vendor Advisory: https://support.undsgn.com/hc/en-us/articles/213454129-Change-Log
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Appearance > Themes. 3. Click on Uncode theme. 4. Click 'Update Now' if update available. 5. Alternatively, download latest version from theme repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable function
allRemove or disable the uncode_admin_get_oembed function in theme files
Web Application Firewall rule
allBlock requests containing file path traversal patterns to the vulnerable endpoint
🧯 If You Can't Patch
- Temporarily switch to default WordPress theme
- Implement strict file permissions and disable directory listing
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Appearance > Themes for Uncode theme version 2.9.1.6 or earlierCheck Version:
wp theme list --field=name,version --path=/path/to/wordpressVerify Fix Applied:
Confirm Uncode theme version is 2.9.1.7 or later in WordPress admin📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /wp-admin/admin-ajax.php with action=uncode_admin_get_oembed containing file path parameters
- Multiple 200 responses for file read attempts
Network Indicators:
- Unusual GET/POST requests to admin-ajax.php with file path parameters
- Traffic patterns indicating file enumeration
SIEM Query:
source="web_access.log" AND uri="/wp-admin/admin-ajax.php" AND query="action=uncode_admin_get_oembed" AND (query="file=" OR query="path=")