The Trinity Audio WordPress plugin suffers from a CSRF vulnerability due to improper nonce validation in the post management PHP script. This enables attackers to craft malicious requests that, when executed by an authenticated administrator, can change the activation state of posts without proper authorization. The vulnerability affects all plugin versions up to 5.20.2. The CVSS 3.1 base score is 4.3, reflecting a medium severity with low impact on confidentiality and availability but limited integrity impact. No patch or vendor advisory is currently available, and the plugin is not a cloud service, so remediation depends on the vendor releasing an update.

An attacker can cause an authenticated site administrator to unknowingly activate or deactivate posts by tricking them into clicking a malicious link or visiting a crafted webpage. This could lead to unauthorized content changes on the affected WordPress site. There is no direct impact on confidentiality or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should exercise caution when clicking on links or visiting untrusted sites while logged into the WordPress admin panel. Implementing additional CSRF protections or disabling the plugin temporarily may reduce risk.