CVE-2025-9196

The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration data.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3373045%40trinity-audio&new=3373045%40trinity-audio&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/64889659-24d6-40d9-97ba-b448f5205a96?source=cve

Configurations

No configuration.

History

08 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) El plugin para WordPress Trinity Audio - Text to Speech AI audio player para convertir contenido en audio es vulnerable a la Exposición de Información Sensible en todas las versiones hasta la 5.21.0, inclusive, a través del archivo ~/admin/inc/phpinfo.php que se crea durante la instalación. Esto permite a atacantes no autenticados extraer datos sensibles, incluyendo datos de configuración.

Information

Published : 2025-10-11 08:15

Updated : 2026-10-08 13:10

NVD link : CVE-2025-9196

Mitre link : CVE-2025-9196

CVE.ORG link : CVE-2025-9196

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2025-9196", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9196", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T13:31:23.432338Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "sergiotrinity", "product": "Trinity Audio \u2013 Text to Speech AI audio player to convert content into audio", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.21.0"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-11T08:15:32.353", "references": [{"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3373045%40trinity-audio&new=3373045%40trinity-audio&sfp_email=&sfph_mail=", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/64889659-24d6-40d9-97ba-b448f5205a96?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The Trinity Audio \u2013 Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration data."}, {"lang": "es", "value": "El plugin para WordPress Trinity Audio - Text to Speech AI audio player para convertir contenido en audio es vulnerable a la Exposici\u00f3n de Informaci\u00f3n Sensible en todas las versiones hasta la 5.21.0, inclusive, a trav\u00e9s del archivo ~/admin/inc/phpinfo.php que se crea durante la instalaci\u00f3n. Esto permite a atacantes no autenticados extraer datos sensibles, incluyendo datos de configuraci\u00f3n."}], "lastModified": "2026-10-08T13:10:00.200", "sourceIdentifier": "security@wordfence.com"}