CVE-2025-3431 ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated Arbitrary File Download

What is CVE-2025-3431?

CVE-2025-3431 is a high-severity path traversal vulnerability in ZoomIt ZoomSounds - WordPress Wave Audio Player with Playlist, published on 8 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Weakness: CWE-73

Which versions are affected by CVE-2025-3431?

It affects 1 product.

Products include Digitalzoomstudio Zoomsounds.

How do I fix CVE-2025-3431?

No fix has been published for CVE-2025-3431 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-3431 being exploited?

There is no known exploitation of CVE-2025-3431 in the wild and no public exploit code.

Other vulnerabilities in ZoomIt ZoomSounds - WordPress Wave Audio Player with Playlist

• CVE-2025-47568 WordPress ZoomSounds plugin <= 6.91 - PHP Object Injection vulnerability Critical 9.8
• CVE-2021-4449 ZoomSounds <= 5.96 - Unauthenticated Arbitrary File Upload Critical 9.8
• CVE-2015-9471 File upload in n/a Critical 9.8
• CVE-2021-4457 ZoomSounds < 6.05 - Unauthenticated Arbitrary File Upload Critical 9.1
• CVE-2024-13776 Missing authorization in ZoomSounds - WordPress Wave Audio Player with Playlist High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5f75-cgx5-chc6.