blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24472

CRITICAL 9.8 CVSS 3.1
Published
August 2, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-918
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.

Affected products and versions

  • QantumThemes QT KenthaRadio — From 2.0.2 (including) to 2.0.2 (excluding)
  • QantumThemes OnAir2 — From 3.9.9.2 (including) to 3.9.9.2 (excluding)
  • qantumthemes kentharadio — Before 2.0.2
  • qantumthemes onair2 — Before 3.9.9.2

References

  • wpscan.com https://wpscan.com/vulnerability/17591ac5-88fa-4cae-a61a-4dcf5dc0b72a Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record