What is the CVSS score of CVE-2021-4457?

CVE-2021-4457 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2021-4457?

CVE-2021-4457 is a critical unauthenticated file upload vulnerability in ZoomSounds WordPress plugin (versions before 6.05) that allows remote attackers to execute arbitrary code on affected web…. A patch is available.

Is there a public PoC exploit available for CVE-2021-4457?

Yes, a public proof-of-concept exploit is available for CVE-2021-4457. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2021-4457?

Within 24 hours: Identify all WordPress instances using ZoomSounds plugin via security scanner or manual audit; disable the plugin temporarily if version is below 6.05. Within 7 days: Update ZoomSounds plugin to version 6.05 or later across all installations; verify updates completed and plugin re-enabled only after patch confirmation. Within 30 days: Review server logs (web server and WordPress) for suspicious file uploads to /wp-content/uploads/ or plugin directories dated prior to patch deployment; scan for webshells or malicious files; reset all WordPress administrative credentials as precaution.

PHP CVE-2021-4457

EUVD-2021-34682 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-06-25 contact@wpscan.com

PHP WordPress RCE Zoomsounds Digitalzoomstudio

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:53 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.05

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2021-34682

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

PoC Detected

Jul 07, 2025 - 17:40 vuln.today

Public exploit code

CVE Published

Jun 25, 2025 - 15:15 nvd

CRITICAL 9.1

DescriptionCVE.org

The ZoomSounds plugin before 6.05 contains a PHP file allowing unauthenticated users to upload an arbitrary file anywhere on the web server.

AnalysisAI

CVE-2021-4457 is an unauthenticated arbitrary file upload vulnerability in the ZoomSounds WordPress plugin versions before 6.05. The vulnerability exists in a PHP file that fails to implement proper access controls, allowing remote attackers to upload malicious files anywhere on the web server without authentication. This critical flaw enables complete system compromise through remote code execution, with a CVSS score of 9.1 indicating severe impact. While specific KEV and EPSS data are not provided in the available intelligence, the combination of unauthenticated access (CVSS AV:N/PR:N), high impact to confidentiality and integrity, and the prevalence of WordPress plugin exploitation in the wild suggests this represents an actively exploited vulnerability in real-world deployments.

Technical ContextAI

ZoomSounds is a WordPress audio player plugin distributed through the WordPress.org plugin repository. The vulnerability stems from inadequate input validation and access control in a PHP file handler, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The root cause is the absence of authentication checks (PR:N in CVSS vector) combined with insufficient file type validation, allowing attackers to bypass WordPress security functions and upload executable PHP files. The attack vector is network-based (AV:N) with low complexity (AC:L), meaning no special conditions or user interaction is required. The CPE context would be: cpe:2.3:a:zoomsounds:zoomsounds:*:*:*:*:*:wordpress:*:* with version constraints <6.05. This affects any WordPress installation with the vulnerable plugin active, regardless of WordPress hardening.

RemediationAI

Immediate remediation steps: (1) Update ZoomSounds plugin to version 6.05 or later immediately through WordPress admin dashboard (Plugins > Updates) or manually via WordPress.org repository download, (2) After patching, audit the web server for suspicious uploaded files, particularly in wp-content/uploads and other world-writable directories, checking modification timestamps around vulnerability discovery dates, (3) Search web server logs for POST requests to the vulnerable PHP file endpoint with upload parameters to identify exploitation attempts, (4) If unable to update immediately, disable the ZoomSounds plugin entirely (Deactivate and Delete) until patching can be completed, (5) Implement Web Application Firewall (WAF) rules to block file upload requests to ZoomSounds plugin endpoints as temporary mitigation, (6) Consider restricting PHP execution in wp-content/uploads directory via .htaccess (AddType text/plain .php) to prevent execution of uploaded malicious files. No vendor advisory link is provided in available intelligence; refer to WordPress.org ZoomSounds plugin page and WPVULNDB for official patch confirmation.