CVE-2021-4457: The ZoomSounds plugin before 6.05 contains a PHP file allowing unauthenticated users to upload an arbitrary file anywhere on the web server.

PriorityP262critical9.1CVSS 3.1

AVNACLPRNUINSUCHIHAN

EPSS

0.38%

30.0th percentile

The ZoomSounds plugin before 6.05 contains a PHP file allowing unauthenticated users to upload an arbitrary file anywhere on the web server.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
digitalzoomstudio	zoomsounds	< 6.05	6.05
digitalzoomstudio	zoomsounds	<= 5.96	—
zoomit	zoomsounds_wordpress_wave_audio_player_with_playlist	<= 5.96	—

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vulncheck9.8CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.