CVE-2024-12579: WordPress Minify HTML Plugin ReDoS Vulnerability

CVE-2024-12579 Overview

CVE-2024-12579 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Minify HTML plugin for WordPress. The flaw affects all plugin versions up to and including 2.1.10. The plugin processes user-supplied comment input as a regular expression, allowing an attacker to trigger catastrophic backtracking. Unauthenticated attackers can submit crafted comments that consume excessive CPU cycles and break page rendering. The issue is categorized under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
Unauthenticated attackers can post crafted comments that trigger catastrophic regex backtracking, exhausting server CPU and disrupting availability of affected WordPress pages.

Affected Products

Minify HTML plugin for WordPress, versions up to and including 2.1.10
WordPress sites using the minify-html-markup plugin
Any site accepting unauthenticated comments while the vulnerable plugin is active

Discovery Timeline

2024-12-13 - CVE-2024-12579 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12579

Vulnerability Analysis

The Minify HTML plugin compresses HTML output before sending it to browsers. During processing, the plugin passes user-controlled content into a regular expression evaluation path without adequate sanitization. When comment text contains patterns that interact poorly with the regex engine, the engine enters catastrophic backtracking. A single crafted comment can lock a PHP worker for seconds or longer per request. Repeated requests can starve the web server of workers and render pages unavailable. The vulnerability requires no authentication and no user interaction to exploit.

Root Cause

The root cause is treating user-supplied input as part of a regular expression pattern. The plugin lacks input validation and does not enforce time or complexity limits on regex evaluation. Nested quantifiers or overlapping alternations in the affected regex expand execution time exponentially against attacker-chosen input, which is the classic ReDoS condition described by [CWE-400].

Attack Vector

An unauthenticated attacker submits a comment containing a payload engineered to trigger backtracking in the plugin's minification regex. When the comment content is processed during page rendering, the PHP process consumes CPU while the regex engine explores exponential match paths. Repeated submissions amplify the impact and can degrade the entire site.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Analysis for additional context on the affected code path.

Detection Methods for CVE-2024-12579

Indicators of Compromise

Sustained spikes in PHP-FPM or Apache CPU usage correlated with comment submission requests
HTTP request timeouts or 502/504 responses on pages that render comments
Comment payloads containing long repeating character sequences or unusual patterns targeting regex alternation
Error logs referencing PCRE backtrack limit exhaustion such as preg_match(): Backtrack limit was exhausted

Detection Strategies

Monitor web application logs for POST requests to wp-comments-post.php with abnormally large or repetitive payloads
Alert on requests to pages using the Minify HTML plugin that exceed baseline response times
Inspect comment moderation queues for entries containing suspicious repeating patterns before publication

Monitoring Recommendations

Track per-request CPU time and PHP execution duration for pages served through the plugin
Enable rate limiting on comment submission endpoints and alert on threshold breaches from single source addresses
Correlate spikes in max_execution_time timeouts with recent comment activity to identify probing behavior

How to Mitigate CVE-2024-12579

Immediate Actions Required

Update the Minify HTML plugin to a version later than 2.1.10 that includes the fix from WordPress changeset 3203890
Disable the Minify HTML plugin on affected sites until the update is applied
Enable comment moderation so unauthenticated comments are reviewed before entering the rendering pipeline
Deploy web application firewall (WAF) rules that reject comment payloads with excessive repeating character classes

Patch Information

The vendor addressed the vulnerability in the plugin repository. See the WordPress Change Log for the exact code changes and the Wordfence Vulnerability Analysis for additional remediation guidance.

Workarounds

Deactivate the Minify HTML plugin until patched builds are installed across all WordPress instances
Restrict anonymous commenting or require authentication before comments are accepted
Lower PHP pcre.backtrack_limit values to fail fast on pathological patterns and reduce worker starvation

bash

# Configuration example: tighten PCRE limits in php.ini to reduce ReDoS impact
pcre.backtrack_limit = 100000
pcre.recursion_limit = 100000
max_execution_time = 10