ZoomSounds - Arbitrary File Upload (CVE-2021-4449)
Description
The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
psychologyCrowdSec Analysis
CVE-2021-4449 is a critical vulnerability in the ZoomSounds WordPress plugin that allows unauthenticated attackers to upload arbitrary files due to insufficient file type validation in the 'savepng.php' file. This flaw can be exploited to achieve remote code execution on the affected server, potentially leading to full site compromise.
CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2021-4449 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the ZoomSounds plugin by sending unauthenticated POST requests to /wp-content/plugins/dzs-zoomsounds/savepng.php with a crafted location parameter, enabling arbitrary file uploads and remote code execution.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-10-16 |
| Rule Released | 2025-12-10 |
| CrowdSec First Seen | 2025-12-15 |
Remediation & Protection
External References
- https://ithemes.com/blog/wordpress-vulnerability-report-june-2021-part-5/#ib-toc-anchor-2
- https://wpscan.com/vulnerability/07259a61-8ba9-4dd0-8d52-cc1df389c0ad
- https://github.com/0xAgun/Arbitrary-File-Upload-ZoomSounds
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4449.yaml