High severity7.5NVD Advisory· Published Apr 8, 2025· Updated Jun 17, 2026

CVE-2025-3431

Description

The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected products

WordPress/ZoomSounds - WordPress Wave Audio Player with Playlistllm-create
Range: <=6.91
ZoomIt/ZoomSounds - WordPress Wave Audio Player with Playlistv5
Range: 0

Patches

Vulnerability mechanics

References

www.wordfence.com/threat-intel/vulnerabilities/id/a78998da-1cb1-4991-95a8-a551bde04064nvdThird Party Advisory
codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-playlist/6181433nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000