CVE-2026-3191: 
WordPress vulnerability analysis and mitigation

CVE-2026-3191 is a Cross-Site Request Forgery (CSRF) vulnerability in the Minify HTML plugin for WordPress, affecting all versions up to and including 2.1.12. The flaw exists in the minify_html_menu_options function due to missing or incorrect nonce validation, allowing unauthenticated attackers to modify plugin settings by tricking an administrator into clicking a malicious link. It was published on March 31, 2026, with a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-352 (Cross-Site Request Forgery), specifically the absence of proper nonce validation in the minify_html_menu_options function (visible at line 139 of minify-html.php in version 2.1.12). Because WordPress nonces are not verified before processing settings updates, a forged HTTP request submitted in the context of an authenticated administrator session can successfully alter plugin configuration. Exploitation requires social engineering — the attacker must trick a logged-in site administrator into visiting a malicious page or clicking a crafted link that submits the forged request (GitHub Advisory, WordPress Trac).

Successful exploitation allows an unauthenticated attacker to modify the Minify HTML plugin's configuration on the affected WordPress site, resulting in low integrity and low availability impacts with no confidentiality exposure. Depending on the plugin settings altered, an attacker could disrupt HTML minification behavior, potentially breaking site functionality or injecting undesired configuration changes. The scope is limited to the affected WordPress installation and does not directly enable remote code execution or data exfiltration (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.012% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Minify HTML plugin (version ≤ 2.1.12) by inspecting page source for plugin-specific HTML comments or using web fingerprinting tools.
2. Craft forged request: Construct an HTTP POST request targeting the WordPress admin settings endpoint for the Minify HTML plugin (e.g., wp-admin/options-general.php?page=minify-html) with desired malicious parameter values and no valid nonce.
3. Deliver payload: Embed the forged request in a malicious web page (e.g., as a hidden HTML form with auto-submit JavaScript) or disguise it as a link in a phishing email targeting the site administrator.
4. Trigger execution: When the authenticated administrator visits the attacker-controlled page or clicks the link, the browser automatically submits the forged request with the administrator's session cookies, causing the plugin settings to be updated without the administrator's knowledge (GitHub Advisory, WordPress Trac).

• Logs: Unexpected POST requests to wp-admin/options-general.php or similar admin settings pages from unusual referrer URLs or external origins in WordPress access logs.
• File System: Changes to plugin configuration stored in the WordPress database (wp_options table) for the minify_html option key at unexpected times.
• Logs: WordPress admin action logs (if an audit plugin is installed) showing settings changes to the Minify HTML plugin without a corresponding administrator login session from a known IP.

Administrators should update the Minify HTML plugin to a version newer than 2.1.12, which includes the fix adding proper nonce validation to the minify_html_menu_options function. The patch is available via the WordPress plugin repository changeset. As a general defense-in-depth measure, administrators should be cautious about clicking links from untrusted sources while logged into the WordPress admin panel, and consider implementing Content Security Policy (CSP) headers to reduce CSRF risk (WordPress Trac Changeset, Wordfence).