Security readout for executives and security teams
Plain-English summary
This CVE affects WordPress sites using older QantumThemes OnAir2 theme or QT KenthaRadio plugin. An unauthenticated visitor could abuse exposed proxy functionality so the website server fetches and displays content from attacker-chosen URIs, creating SSRF and remote file inclusion risk.
Executive priority
Treat this as a near-term remediation item for any public WordPress site using these products. Prioritize confirmation and upgrade, especially where the site can reach internal services or sensitive metadata endpoints.
Technical view
OnAir2 before 3.9.9.2 and QT KenthaRadio before 2.0.2 exposed proxy behavior without authentication. The vulnerable server could be induced to request arbitrary URIs and return the fetched content, mapped to CWE-918 SSRF and described as also enabling RFI.
Likely exposure
Exposure is likely limited to WordPress installations running OnAir2 versions before 3.9.9.2 or QT KenthaRadio versions before 2.0.2. Public internet-facing WordPress sites are the main concern because the issue is unauthenticated.
Exploitation context
The provided sources do not report active exploitation, and the CVE is not listed as KEV in the bundle. However, unauthenticated SSRF/RFI exposure on public WordPress sites is operationally serious because attackers may reach internal resources or include remote content.
Researcher notes
Evidence is concise but consistent: the issue is unauthenticated proxy functionality causing arbitrary URI fetch and display. The bundle provides no CVSS vector, proof of exploitation, affected endpoint details, or vendor advisory beyond WPScan/CVE references.
Mitigation direction
- Upgrade OnAir2 to version 3.9.9.2 or later.
- Upgrade QT KenthaRadio to version 2.0.2 or later.
- Remove or disable the affected theme or plugin if it cannot be updated.
- Check QantumThemes or WPScan guidance for any additional hardening notes.
Validation and detection
- Inventory WordPress sites for OnAir2 and QT KenthaRadio installations.
- Confirm installed versions are not below the fixed versions named in the CVE.
- Review web logs for unauthenticated requests to theme or plugin proxy functionality.
- Check for unexpected outbound requests from affected WordPress servers.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-24472 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/17591ac5-88fa-4cae-a61a-4dcf5dc0b72aCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.