CVE-2021-4449

CRITICALNuclei

ZoomSounds <= 5.96 - Unauthenticated Arbitrary File Upload

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-4449 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2021-4457 is a duplicate of this.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 7, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 16, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

ZoomSounds - WordPress Wave Audio Player with Playlist

Browse ZoomIt / ZoomSounds - WordPress Wave Audio Player with Playlist

Default status: unaffected

CVE ListThrough 5.96affected

zoomsounds

Browse digitalzoomstudio / zoomsounds
VulnCheckVersion data not supplied

zoomsounds

Browse zoomit / zoomsounds

Default status: unknown

CVE ListThrough 5.96affected

Nuclei templates

1
ProjectDiscoveryCRITICALZoomSounds Plugin - Unauthenticated Arbitrary File UploadCVSS 9.8

ZoomSounds plugin for WordPress contains a file upload vulnerability in savepng.php

Impact

Unauthenticated attackers can upload arbitrary PHP files via savepng.php without authentication or validation, achieving remote code execution and complete server compromise.

Remediation

Upgrade to ZoomSounds plugin version that addresses the file upload vulnerability.

WeaknessesCWE-434
Authors0xnemian
Template tagscvecve2021wpscanwpzoomsoundsintrusivefile-uploadvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:digitalzoomstudio:zoomsounds:*:*:*:*:*:wordpress:*:*
FOFA: body="/wp-content/plugins/dzs-zoomsounds/"
https://wpscan.com/vulnerability/07259a61-8ba9-4dd0-8d52-cc1df389c0ad https://codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-playlist/6181433 https://github.com/0xAgun/Arbitrary-File-Upload-ZoomSounds https://ithemes.com/blog/wordpress-vulnerability-report-june-2021-part-5/#ib-toc-anchor-2 https://www.wordfence.com/threat-intel/vulnerabilities/id/262e3bb3-bc83-4d0b-8056-9f94ec141b8f?source=cve

Source: ProjectDiscovery

References

7