What is the CVSS score of CVE-2021-4449?

CVE-2021-4449 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 81.6%.

Which versions of ZoomSounds Plugin are affected by CVE-2021-4449?

The ZoomSounds WordPress plugin (versions 5.96 and earlier) contains a critical unauthenticated remote code execution vulnerability that allows attackers to upload malicious files and execute…

Is there a public PoC exploit available for CVE-2021-4449?

Yes, a public proof-of-concept exploit is available for CVE-2021-4449. Prioritise patching immediately. EPSS: 81.6%.

How to fix or mitigate CVE-2021-4449?

Within 24 hours: Inventory all WordPress installations to identify ZoomSounds plugin versions ≤5.96; disable and remove the plugin immediately. Within 7 days: For systems where plugin removal is not immediately feasible, implement web application firewall (WAF) rules to block POST requests to the /wp-content/plugins/zoomsounds/savepng.php endpoint and restrict file upload permissions. Within 30 days: Migrate to an alternative WordPress audio plugin or replace affected WordPress installations if ZoomSounds functionality is business-critical.

ZoomSounds Plugin CVE-2021-4449

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2024-10-16 security@wordfence.com

File Upload RCE WordPress PHP Zoomsounds

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Apr 08, 2026 - 17:16 vuln.today

Public exploit code

CVE Published

Oct 16, 2024 - 07:15 nvd

CRITICAL 9.8

DescriptionCVE.org

The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2021-4457 is a duplicate of this.

AnalysisAI

Unauthenticated arbitrary file upload in the ZoomSounds WordPress plugin (versions ≤5.96) allows remote attackers to upload malicious PHP files via the 'savepng.php' endpoint, enabling remote code execution on the underlying webserver. Publicly available exploit code exists, and the EPSS score of 81.62% (99th percentile) indicates a very high likelihood of opportunistic exploitation, particularly against the large WordPress install base where this plugin is deployed.

Technical ContextAI

The vulnerability resides in the 'savepng.php' handler shipped with the DigitalZoomStudio ZoomSounds audio plugin for WordPress (CPE cpe:2.3:a:digitalzoomstudio:zoomsounds), which fails to validate the MIME type or extension of uploaded files. This is a textbook CWE-434 (Unrestricted Upload of File with Dangerous Type) flaw: by accepting attacker-controlled content without enforcing an allowlist, the script permits PHP payloads to be written into a webroot-accessible directory where the PHP interpreter will execute them. WordPress plugins of this type are commonly installed in default Apache/Nginx + PHP-FPM stacks, making the uploaded file directly reachable by HTTP.

RemediationAI

Upgrade the ZoomSounds plugin to a version greater than 5.96; the exact fixed release is not enumerated in the provided data, so administrators should pull the latest available build from the vendor (DigitalZoomStudio via CodeCanyon) and verify the 'savepng.php' file either enforces extension/MIME allowlists or has been removed. If immediate upgrade is not possible, deploy a WAF rule (Wordfence, ModSecurity, or equivalent) blocking POST requests to '/wp-content/plugins/zoomsounds/savepng.php' - note this will break legitimate plugin functionality that relies on that endpoint. As a stronger compensating control, restrict PHP execution within the plugin's upload directory using an .htaccess 'php_flag engine off' rule or Nginx location block, which prevents uploaded files from executing even if written to disk; the trade-off is that any legitimate dynamic features in that directory will also stop working. Audit the plugin's upload directory immediately for unexpected .php/.phtml files indicating prior compromise.