Trinity Audio CVE-2025-9196

The Trinity Audio plugin must be installed (any version up to and including 5.21.0), which drops a phpinfo() script at the fixed, predictable path ~/admin/inc/phpinfo.php inside the plugin directory; the web server must serve this .php file directly to visitors (the default for files under wp-content/plugins). No authentication, no user interaction, and no special configuration are required - exploitation works against default installations. The practical limiting factors are: the site must actually have this plugin installed, the server must execute and expose the file over HTTP (not blocked by hardening rules or a WAF restricting access to plugin internals), and the sensitivity of the leaked data depends on what the host's phpinfo() reveals (e.g., whether environment variables contain secrets).

This is a medium-severity information disclosure flaw (CVSS 5.3, CWE-200) whose signals are internally consistent but modest. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the file is reachable remotely over the network, at low complexity, by unauthenticated attackers with no user interaction - so exploitation is trivial where the plugin is installed. However, impact is bounded: only confidentiality is affected and only at Low (C:L, I:N, A:N), reflecting that a phpinfo() dump leaks configuration/environment data rather than granting code execution or data modification. EPSS is low at 1.00% (62nd percentile), consistent with the absence of a CISA KEV listing and no identified public exploit, indicating no evidence of active or widespread exploitation despite how easy the flaw is to trigger. No signals conflict: easy-but-low-impact matches the low EPSS and CVSS base of 5.3. The realistic priority is moderate - this is a predictable, scannable exposure (fixed-path phpinfo file) that is more useful as a reconnaissance aid feeding later attacks than as a standalone critical issue. Treat it as a patch-in-normal-cycle item that rises in priority if the host environment variables or secrets would be revealed by phpinfo() on the affected servers.

An unauthenticated attacker requests the predictable file path (~/admin/inc/phpinfo.php) under the Trinity Audio plugin directory on a WordPress site and receives a full phpinfo() output. They harvest server configuration, PHP version, loaded modules, file paths, and environment variables to fingerprint the stack and plan follow-on attacks. No public exploit code is required - the flaw is triggered by a single HTTP GET and is easily automated by vulnerability scanners.