The Trinity Audio – Text to Speech AI audio player plugin for WordPress contains a Cross‑Site Request Forgery condition created by missing or defective nonce verification in the post‑management endpoint. An attacker who conditions an administrator to click a crafted link can thereby cause the administrator to activate or deactivate posts without authorization. The effect is the unauthorized alteration of content visibility or publication status, which can undermine editorial control and lead to misinformation or reputational damage.

WordPress installations running the Trinity Audio plugin from the vendor sergiotrinity, for all versions up to and including 5.20.2, are affected. The vulnerability resides in the /admin/inc/post-management.php handler used to change post status.

The CVSS score of 4.3 denotes medium severity. An EPSS score of less than 1 % indicates a currently low likelihood of exploitation. The vulnerability does not appear in the CISA KEV catalog. Exploitation requires remote social engineering – the attacker must persuade a site administrator to execute a malicious request, usually by clicking a deceptive link, which then triggers the control flow that changes post status.