The ZoomSounds WordPress plugin suffers from an arbitrary file read vulnerability (CWE-73) exploitable through the 'dzsap_download' action. This flaw permits unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive information. The vulnerability affects all versions up to 6.91. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or vendor advisory has been provided yet.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the server hosting the vulnerable plugin. This can lead to disclosure of sensitive information such as configuration files, credentials, or other data stored on the server. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the vulnerable plugin functionality to prevent exploitation.