CVE-2021-4449: ZoomSounds <= 5.96 - Unauthenticated Arbitrary File Upload
The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2021-4457 is a duplicate of this.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-4449?
CVE-2021-4449 is considered a medium severity vulnerability due to its potential for arbitrary file uploads.
How do I fix CVE-2021-4449?
To fix CVE-2021-4449, update the ZoomSounds plugin to the latest version beyond 5.96 that addresses the file upload vulnerability.
Who is affected by CVE-2021-4449?
CVE-2021-4449 affects installations of the ZoomSounds plugin for WordPress versions 5.96 and earlier.
What kind of attacks can result from CVE-2021-4449?
CVE-2021-4449 allows unauthenticated attackers to upload potentially malicious files to the affected WordPress site.
Is there a workaround for CVE-2021-4449?
A potential workaround for CVE-2021-4449 is to disable the ZoomSounds plugin until you can apply the necessary update.