Created
17th August 2023
Updated
17th August 2023
This request is being scanned by bots looking for any Wordpress installation running ZoomSounds plugin, version under 6.05. The exploit was published around June 2021 and has a corresponding Metasploit module associated with it.
There was a vulnerability which allowed unauthenticated, arbitrary file upload - or to put it plainly, you could send a POST request with some payload and the plugin would save it to your server without authentication.
There have been other arbitrary file upload vulnerabilities in this plugin over the years: CVE-2015-9471 documents a simple attack on the plugin; and more recently, CVE-2021-39316 documents a traversal attack. The plugin is fairly unsafe given it's long and colourful history as being an attack vector and I'd advise Wordpress owners to find alternatives.
If you're running this plugin, ensure it's up to date. If you know you're not running this plugin or Wordpress, you're probably safe to disregard this.