CVE-2025-3431

HIGH

ZoomSounds - WordPress Wave Audio Player with Playlist <6.91 - Info...

Title source: llm

Description

The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

References (2)

[Product] https://codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-playlist/6181433

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/a78998da-1cb1-4991-95a8-a551bde04064?source=cve

Scores

CVSS v3 7.5

EPSS 0.0049

EPSS Percentile 65.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-73

Status published

Products (2)

digitalzoomstudio/zoomsounds < 6.91

ZoomIt/ZoomSounds - WordPress Wave Audio Player with Playlist < 6.91

Published Apr 08, 2025

Tracked Since Feb 18, 2026