ZoomSounds – WordPress Wave Audio Player with Playlist is vulnerable through the 'dzsap_download' action to arbitrary file read. The flaw allows an attacker to specify any file path on the server and obtain its contents, potentially revealing confidential data such as configuration files, credentials or other sensitive documents. This vulnerability is categorized as CWE‑73, indicating an insecure file-handling function that does not validate input properly.

The affected product is the ZoomSounds WordPress plugin distributed by DigitalZoomStudio. All releases through version 6.91, inclusive, are impacted. WordPress sites running this plugin across any environment are at risk if the plugin remains installed at these versions.

The CVSS score of 7.5 classifies the issue as high severity. EPSS reports a likelihood of less than 1%, suggesting current exploitation activity is low, and the vulnerability is not yet listed in the CISA KEV catalog. Nonetheless, the flaw is reachable through unauthenticated HTTP requests to the plugin’s download endpoint, meaning a web-based attacker can trigger it without additional credentials. The potential damage spans from data leakage to further compromise if sensitive files are retrieved.