PT-2025-15385 · WordPress · Zoomsounds

Mohammadamin Alidoost · Publicado 2025-04-08 · Atualizado 2025-06-05 · CVE-2025-3431

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: ZoomSounds - WordPress Wave Audio Player with Playlist versions up to and including 6.91

Description: The issue allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information, via the 'dzsap download' action. This enables access to potentially confidential data stored in files on the server.

Recommendations: For versions up to and including 6.91, update to a version later than 6.91 to resolve the issue. As a temporary workaround, consider restricting access to the 'dzsap download' action to prevent unauthenticated file reads until a patch is available.

Correção

Enumeração de Fraquezas

CWE-73

Identificadores relacionados

CVE-2025-3431

Produtos afetados

Zoomsounds

Referências · 11

• https://t.me/cvedetector/22416 · Publicação no Telegram
• https://twitter.com/dailycve/status/1930595418200518752 · Publicação no Twitter
• https://twitter.com/cybercronai/status/1909668222187503887 · Publicação no Twitter
• https://t.me/cvenotify/124683 · Publicação no Telegram
• https://twitter.com/vulns_space/status/1909532035732881858 · Publicação no Twitter
• https://t.me/cvetracker/21103 · Publicação no Telegram
• https://codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-playlist/6181433 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-3431 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/a78998da-1cb1-4991-95a8-a551bde04064?source=cve · Nota
• https://osv.dev/vulnerability/CVE-2025-3431 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1909528286474256647 · Publicação no Twitter