CVE-2025-9196
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-11

Last updated on: 2025-10-14

Assigner: Wordfence

Description
The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration data.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-11
Last Modified
2025-10-14
Generated
2026-06-16
AI Q&A
2025-10-11
EPSS Evaluated
2026-06-14
NVD
CVE-2025-9196
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
trinity_audio wordpress_plugin 5.21.0
trinity_audio wordpress_plugin 5.22.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in the Trinity Audio WordPress plugin (up to version 5.21.0) involves Sensitive Information Exposure through a file named ~/admin/inc/phpinfo.php that is created upon installation. This file allows unauthenticated attackers to access sensitive configuration data.

Impact Analysis

This vulnerability can allow unauthenticated attackers to extract sensitive configuration data from the plugin, potentially exposing information that could be used to further compromise the system or understand its configuration.

Detection Guidance

You can detect this vulnerability by checking if the file `admin/inc/phpinfo.php` exists in your Trinity Audio WordPress plugin installation directory. For example, use the command `ls wp-content/plugins/trinity-audio/admin/inc/phpinfo.php` on the server hosting your WordPress site. If the file exists and the plugin version is 5.21.0 or earlier, your system is vulnerable. [2]

Mitigation Strategies

To mitigate this vulnerability, immediately update the Trinity Audio WordPress plugin to version 5.22.0 or later. This update removes the vulnerable `admin/inc/phpinfo.php` file and includes improved security measures. [2]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-9196. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart