CVE-2021-39316: Zoomsounds WordPress plugin path traversal allows arbitrary file download

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated arbitrary file read with public exploit references and very high EPSS, though not in KEV and no ransomware association.

What it is

The Zoomsounds plugin for WordPress through version 6.45 exposes a `dzsap_download` action that passes the `link` parameter without proper validation, allowing directory traversal. An unauthenticated attacker can read arbitrary files on the server, including sensitive configuration files such as wp-config.php. This matters because wp-config.php contains database credentials and authentication salts, which can lead to full site compromise.

Impact

An attacker gains read access to any file the web server can read, including wp-config.php, exposing database credentials and secret keys. This can enable database access, session forgery, or further lateral compromise of the WordPress installation.

Attack surface

Reachable over the network through the WordPress plugin's `dzsap_download` action with a crafted `link` parameter; the CVSS vector shows no privileges or user interaction required. No authentication is needed to trigger the traversal.

Exploitation

Not listed in CISA KEV, but EPSS is 0.65763 (99.2nd percentile) and public exploit references exist, indicating high likelihood of active exploitation. The Packet Storm reference is tagged Exploit.

What to do

• Update the Zoomsounds plugin to a version newer than 6.45 if available; if no fixed version exists, remove or disable the plugin.
• Block or restrict access to the `dzsap_download` action at the web server or WAF level.
• Move wp-config.php outside the web root or restrict file permissions so the web server cannot read it.
• Rotate database credentials and WordPress salts if compromise is suspected.
• Audit web server logs for traversal patterns in requests to the plugin endpoint.

Detection

• Search web server logs for requests to `dzsap_download` containing `../` or encoded traversal sequences in the `link` parameter.
• Monitor for access to sensitive files such as wp-config.php via the plugin endpoint.
• Alert on unusual outbound or file-read activity from the WordPress process.
• Review plugin inventory for Zoomsounds versions 6.45 and below.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.