# CVE-2021-4449: ZoomSounds - Arbitrary File Upload

> Live exploitation tracking for CVE-2021-4449 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-4449

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** ZoomIt ZoomSounds - WordPress Wave Audio Player with Playlist
- **Weaknesses:** CWE-434 (Unrestricted Upload of File with Dangerous Type)
- **Tags:** wordpress

## Description

The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

## CrowdSec analysis

[CVE-2021-4449](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-4449) is a critical vulnerability in the ZoomSounds WordPress plugin that allows unauthenticated attackers to upload arbitrary files due to insufficient file type validation in the 'savepng.php' file. This flaw can be exploited to achieve remote code execution on the affected server, potentially leading to full site compromise.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2021-4449 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the ZoomSounds plugin by sending unauthenticated POST requests to `/wp-content/plugins/dzs-zoomsounds/savepng.php` with a crafted `location` parameter, enabling arbitrary file uploads and remote code execution.

## Timeline

- 2024-10-16: CVE Published. CVE-2021-4449 is published to NVD.
- 2025-12-10: Rule Released. CrowdSec releases a rule to detect CVE-2021-4449 exploitation attempts against the CrowdSec Network.
- 2025-12-15: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-4449 for the first time.

## References

- https://ithemes.com/blog/wordpress-vulnerability-report-june-2021-part-5/#ib-toc-anchor-2
- https://wpscan.com/vulnerability/07259a61-8ba9-4dd0-8d52-cc1df389c0ad
- https://github.com/0xAgun/Arbitrary-File-Upload-ZoomSounds
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4449.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-4449) follows observed exploitation activity for CVE-2021-4449. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.