CVE-2021-4449: fallo crítico en ZoomIt ZoomSounds - WordPress Wave Audio…
ZoomSounds <= 5.96 - Unauthenticated Arbitrary File Upload
Publicada el · Actualizada el
65Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 5.4%
de la publicación al arma
Publicada en NVD16 oct
VulnCheck+387d
probabilidad de explotación
5.4%top 8% de las CVE
explotación observada
síVulnCheck
The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2021-4457 is a duplicate of this.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
ZoomIt · ZoomSounds - WordPress Wave Audio Player with PlaylistCVEs relacionadas — ZoomIt ZoomSounds - WordPress Wave Audio…
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-39316HIGHZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information DislosureEPSS 65.8%CVE-2024-13777HIGHZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated PHP Object InjectionEPSS 0.6%CVE-2025-3431HIGHZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated Arbitrary File DownloadEPSS 0.4%CVE-2024-13776HIGHZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings ManipulationEPSS 0.4%CVE-2025-0839MEDIUMZoomSounds <= 6.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%
Referencias
https://codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-playlist/6181433https://github.com/0xAgun/Arbitrary-File-Upload-ZoomSoundshttps://ithemes.com/blog/wordpress-vulnerability-report-june-2021-part-5/#ib-toc-anchor-2https://sploitus.com/exploit?id=WPEX-ID:07259A61-8BA9-4DD0-8D52-CC1DF389C0ADhttps://wpscan.com/vulnerability/07259a61-8ba9-4dd0-8d52-cc1df389c0adhttps://www.wordfence.com/threat-intel/vulnerabilities/id/262e3bb3-bc83-4d0b-8056-9f94ec141b8f?source=cve