CVE-2021-24472: OnAir2 theme and KenthaRadio plugin expose unauthenticated SSRF/RFI proxy

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SSRF/RFI with a 9.8 CVSS score, public exploit references, and a 99th percentile EPSS probability.

What it is

The OnAir2 WordPress theme before 3.9.9.2 and the QT KenthaRadio plugin before 2.0.2 expose proxy functionality to unauthenticated users. Requests to that proxy make the web server fetch and display content from any URI, enabling server-side request forgery and remote file inclusion. Because it is reachable without credentials and rated 9.8, it is a serious risk to any site running the affected versions.

Impact

An attacker can force the server to make arbitrary outbound requests, reaching internal services and metadata endpoints, and can pull remote files into the site. This can lead to internal network reconnaissance, data exposure, and possible code execution depending on what the server can reach.

Attack surface

Reachable over the network through the theme or plugin proxy endpoint with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any unauthenticated visitor who can send HTTP requests can attempt it.

Exploitation

Not listed in CISA KEV, but EPSS is 0.56614 (99th percentile) and both references are tagged Exploit, indicating public exploit material exists and exploitation is likely.

What to do

• Update OnAir2 to 3.9.9.2 or later and QT KenthaRadio to 2.0.2 or later, or remove the theme/plugin if unused.
• Restrict outbound traffic from the web server with egress firewall rules and block access to cloud metadata endpoints such as 169.254.169.254.
• Disable or remove the exposed proxy functionality if it is not required.
• Run the WordPress site behind a WAF that blocks proxy-style parameters and unexpected outbound fetch requests.

Detection

• Review web server and proxy logs for requests to the theme/plugin proxy endpoint with external or internal URI parameters.
• Monitor outbound connections from the web server to internal RFC1918 addresses, localhost, or cloud metadata IPs.
• Look for unexpected files or content appearing in the WordPress uploads or theme directories that were fetched remotely.
• Alert on repeated or anomalous outbound HTTP requests originating from the WordPress process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.