CVE-2025-9196
BaseFortify
Publication date: 2025-10-11
Last updated on: 2025-10-14
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| trinity_audio | wordpress_plugin | 5.21.0 |
| trinity_audio | wordpress_plugin | 5.22.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the Trinity Audio WordPress plugin (up to version 5.21.0) involves Sensitive Information Exposure through a file named ~/admin/inc/phpinfo.php that is created upon installation. This file allows unauthenticated attackers to access sensitive configuration data.
How can this vulnerability impact me? :
This vulnerability can allow unauthenticated attackers to extract sensitive configuration data from the plugin, potentially exposing information that could be used to further compromise the system or understand its configuration.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the file `admin/inc/phpinfo.php` exists in your Trinity Audio WordPress plugin installation directory. For example, use the command `ls wp-content/plugins/trinity-audio/admin/inc/phpinfo.php` on the server hosting your WordPress site. If the file exists and the plugin version is 5.21.0 or earlier, your system is vulnerable. [2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the Trinity Audio WordPress plugin to version 5.22.0 or later. This update removes the vulnerable `admin/inc/phpinfo.php` file and includes improved security measures. [2]