WordPress Plugin ZoomSounds (dzs-zoomsounds) < 6.05 Unauthenticated Arbitrary File Upload

Advisories

severity: critical
date: 11/7/2025
Affecting: ZoomSounds (dzs-zoomsounds) < 6.05
CVE: CVE-2021-4449
CWE: CWE-434 Unrestricted Upload of File with Dangerous Type
CVSS: 9.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: Wordfence Intelligence Advisory
0xAgun GitHub PoC
ExploitDB-50753
Shadowserver Exploitation Evidence
WPScan Advisory (Duplicate CVE)
Credit: ganj
Description: The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.
VulnCheck KEV: This advisory is in the VulnCheck KEV database

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo