Cross-Site Request Forgery Vulnerability in Trinity Audio Plugin for WordPress
CVE-2025-9886
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 4 October 2025
What is CVE-2025-9886?
The Trinity Audio Text to Speech AI plugin for WordPress contains a vulnerability allowing Cross-Site Request Forgery (CSRF) due to inadequate nonce validation in the '/admin/inc/post-management.php' file. This issue impacts all versions up to and including version 5.20.2. Unauthenticated adversaries could exploit this flaw to manipulate post statuses by tricking site administrators into clicking a harmful link, thereby unknowingly executing unauthorized actions.
Affected Version(s)
Trinity Audio – Text to Speech AI audio player to convert content into audio * <= 5.20.2