SSRF in Qantumthemes Kentharadio
CVE-2021-24472
The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display t…
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.566 (99.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Qantumthemes Kentharadio
- Qantumthemes Onair2 — versions 3.9.9.2
- Qantumthemes Qt Kentharadio — versions 2.0.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- contact@wpscan.com (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-24472?
- CVE-2021-24472 is a critical-severity vulnerability in Qantumthemes Kentharadio, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.8/10. Published 2021-08-02.
- How severe is CVE-2021-24472?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2021-24472 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.