By disabling WiFi and mobile data, you shut down some attack paths. That means that your system is more secure, and probably immune to most "script kiddies" attacks.
However, the telephony part will still be active. It is certainly harder to exploit, but a smartphone is far from a 1960s telephone, and even the telephony part has interaction with the phone's OS. That means that is is still possible that a combination of calls and SMS triggers an unexpected condition leading to a possible exploit. I know none of those, because even the Stagefright bug cited by @SteffenUllrich in his answer uses a crafted MMS. And a MMS can only be delivered when mobile data (or possibly WiFi) is active, and will never be if only telephony is allowed.
If you can be sure that god himself was among the engineers that designed your phone system, you are absolutely safe. In any other case, bugs are always possible...
Of course, if you use other functions of your phone like displaying photos, viewing videos, or playing music, you open new doors for attacks with every new application.
