CVE-2026-3191 WordPress.org CVE debrief

Who should care

Administrators of WordPress sites using the Minify HTML plugin should review and update their plugin settings to prevent unauthorized changes. Site administrators should be aware of the vulnerability and take necessary precautions to prevent Cross-Site Request Forgery attacks.

Technical summary

The vulnerability exists due to missing or incorrect nonce validation on the 'minify_html_menu_options' function in the Minify HTML plugin for WordPress. This allows unauthenticated attackers to update plugin settings via a forged request if they can trick a site administrator into performing an action such as clicking on a link. The vulnerability has a CVSS score of 5.4 and a severity of MEDIUM. Affected product deployments should be reviewed and updated to prevent unauthorized changes. Site administrators should be aware of the vulnerability and take necessary precautions to prevent Cross-Site Request Forgery attacks, including confirming whether affected product deployments exist in managed environments and assigning an owner for follow-up. Additionally, reviewing the supplied official advisory or CVE record can help validate affected scope, severity, and vendor guidance.

Defensive priority

Medium priority due to the potential for site administrators to be tricked into performing unintended actions.

Recommended defensive actions

• Review and update Minify HTML plugin settings to prevent unauthorized changes.
• Ensure site administrators are aware of the vulnerability and take necessary precautions.
• Consider implementing additional security measures to prevent Cross-Site Request Forgery attacks.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-03-31T12:16:31.200Z and was last modified on 2026-07-25T10:10:00.167Z. The NVD entry is currently Deferred. The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12. This is due to missing or incorrect nonce validation on the 'minify_html_menu_options' function. Evidence is limited to public CVE and NVD information.

Official resources