CVE-2024-13777 is a high severity (CVSS 8.1) PHP object injection in the ZoomSounds audio player plugin for WordPress, in versions up to and including 6.91, through the margs parameter. Impact depends on other installed code. Update past 6.91. Confirm the fixed release on the vendor's item page.
What's affected
- ZoomSounds WordPress Wave Audio Player with Playlist, all versions up to and including 6.91.
The record does not name a fixed version. ZoomSounds is sold on CodeCanyon, so check the item page and changelog for a release newer than 6.91.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp plugin list --format=table | grep -i zoomsounds
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Update ZoomSounds to a release newer than 6.91.
- Review other plugins and themes for components that could supply a gadget chain.
- Remove the plugin if the audio player is not in use.
- Look up CVE-2024-13777 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The record says untrusted input in the margs parameter is deserialized. Premium plugins bought outside the WordPress directory do not always update automatically, so owners can run old versions for a long time without noticing.
As with other object injection records, the plugin has no known chain on its own. The risk grows with each extra plugin and theme on the site.
This CVE is a PHP object injection flaw (CWE-502, Deserialization of Untrusted Data). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
PHP object injection comes from deserializing data that an outsider controls. When the application rebuilds an object from that data, it can trigger code in the class that was never meant to run for this input.
What happens next depends on what other code is installed. The advisory text says no known gadget chain exists in the vulnerable software itself, so on its own the impact is limited. If another plugin or theme on the same site supplies a usable chain, the result can range from deleting files to data theft to code execution. That makes your full plugin list part of the risk, not just the one component named here.
Quick check
Where do I get updates?
From the vendor's item page, since it is sold on CodeCanyon.
Which parameter is involved?
margs.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
