CVE-2025-67466
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Trinity Audio plugin for WordPress (versions up to and including 5.23.3) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows unauthorized users to perform operations that should be protected.
Risk Assessment
An attacker could exploit the misconfigured access control levels to access functions or data they are not authorized to use. This may lead to unauthorized configuration changes or information disclosure.
Recommendation
Update the Trinity Audio plugin to a version newer than 5.23.3 as soon as a fix becomes available. Until then, consider restricting access to the plugin's functionality or disabling it.
Other vulnerabilities in Trinity Audio
See all- CVE-2025-9952Medium
The Trinity Audio – Text to Speech AI audio player plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'range-date' parameter in all versions up to and including 5.20.2 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if a user is tricked into clicking a link.
- CVE-2025-9886Medium
The Trinity Audio – Text to Speech AI plugin for WordPress up to version 5.20.2 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation in the '/admin/inc/post-management.php' file. Unauthenticated attackers can activate/deactivate posts via a forged request if they trick a site administrator into clicking a link.
Original NVD description (English source)
Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.23.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS