CVE-2021-24838

CVE-2021-24838 describes an Open Redirect vulnerability in the AnyComment WordPress plugin versions prior to 0.3.5. The plugin's API endpoint improperly validates user-supplied input to the redirect parameter before passing it to wp_redirect(), allowing attackers to redirect users to arbitrary malicious sites. This vulnerability is rated Medium severity (CVSS 6.1) due to its network-based attack vector, low complexity, and potential for low impact on confidentiality and integrity, primarily through phishing. While no active exploitation or Metasploit/ExploitDB modules are reported, Nuclei templates exist, and there is minimal community discussion or media coverage.