CVE-2026-24384: Merge + Minify + Refresh CSRF Vulnerability

CVE-2026-24384 Overview

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Merge + Minify + Refresh WordPress plugin developed by launchinteractive. This vulnerability allows attackers to perform unauthorized actions on behalf of authenticated users by exploiting the lack of proper CSRF token validation in the plugin's functionality.

Critical Impact

Attackers can trick authenticated WordPress administrators into executing unintended actions, potentially allowing modification of plugin settings, cache manipulation, or other administrative functions without proper authorization.

Affected Products

• Merge + Minify + Refresh WordPress Plugin version 2.14 and earlier
• WordPress installations with the merge-minify-refresh plugin installed
• All versions from initial release through version 2.14

Discovery Timeline

• January 22, 2026 - CVE-2026-24384 published to NVD
• January 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-24384

Vulnerability Analysis

This CSRF vulnerability (CWE-352) exists in the Merge + Minify + Refresh plugin due to insufficient validation of request authenticity. The plugin fails to implement or properly verify nonce tokens when processing administrative actions, allowing attackers to craft malicious requests that execute in the context of an authenticated administrator's session.

The vulnerability enables network-based attacks that require user interaction. An attacker must convince a logged-in WordPress administrator to visit a malicious page or click a crafted link while authenticated to the target WordPress site. Upon successful exploitation, the attacker can cause unauthorized modifications to plugin settings or trigger plugin functionality without the user's consent.

Root Cause

The root cause of this vulnerability is the absence of proper CSRF protection mechanisms in the plugin's form handling and AJAX endpoints. WordPress provides built-in nonce functions (wp_nonce_field(), wp_verify_nonce(), check_admin_referer()) to prevent CSRF attacks, but these security measures were not adequately implemented in the affected plugin versions.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker would typically:

1. Craft a malicious HTML page containing a hidden form or JavaScript that submits requests to the vulnerable WordPress plugin endpoints
2. Distribute the malicious page through phishing emails, compromised websites, or social engineering
3. Wait for an authenticated WordPress administrator to visit the malicious page
4. The browser automatically sends the forged request along with the user's valid session cookies
5. The plugin processes the request as legitimate, executing the attacker's desired actions

The vulnerability manifests when administrative requests to the plugin are processed without verifying the request origin or validating CSRF tokens. Technical details and proof-of-concept information can be found in the Patchstack CSRF Vulnerability Report.

Detection Methods for CVE-2026-24384

Indicators of Compromise

• Unexpected changes to Merge + Minify + Refresh plugin settings without administrator action
• Unusual administrative activity in WordPress audit logs correlating with visits to external sites
• Modified cached or minified files that weren't manually triggered
• Unexpected HTTP POST requests to plugin endpoints from external referrers

Detection Strategies

• Review WordPress access logs for suspicious POST requests targeting /wp-admin/ endpoints related to the merge-minify-refresh plugin
• Monitor for administrative actions occurring shortly after visits to external domains
• Implement Web Application Firewall (WAF) rules to detect and block CSRF attack patterns
• Enable and review WordPress audit logging for unauthorized plugin configuration changes

Monitoring Recommendations

• Deploy SentinelOne Singularity XDR to monitor for suspicious browser-initiated requests and web-based attacks
• Configure WordPress security plugins to alert on plugin setting modifications
• Implement Content Security Policy (CSP) headers to reduce the attack surface for CSRF exploitation
• Review server access logs regularly for anomalous patterns in administrative endpoint access

How to Mitigate CVE-2026-24384

Immediate Actions Required

• Update the Merge + Minify + Refresh plugin to the latest patched version immediately
• Review plugin settings to ensure no unauthorized modifications have been made
• Audit recent administrative activity for signs of exploitation
• Consider temporarily disabling the plugin until a patch is applied if an update is not yet available

Patch Information

Users should update the Merge + Minify + Refresh plugin to a version newer than 2.14 that includes proper CSRF protection. Check the WordPress plugin repository or the Patchstack vulnerability report for the latest security updates and patch availability.

Workarounds

• Implement a Web Application Firewall (WAF) with CSRF protection rules as a temporary mitigation
• Restrict administrative access to trusted IP addresses only
• Use browser extensions that provide additional CSRF protection
• Ensure administrators log out of WordPress before browsing untrusted websites
• Consider using virtual browsers or separate browser profiles for WordPress administration

# WordPress CLI command to check plugin version
wp plugin list --name=merge-minify-refresh --fields=name,version,update_version

# Update the plugin to the latest version
wp plugin update merge-minify-refresh

# Alternatively, deactivate the plugin until a patch is available
wp plugin deactivate merge-minify-refresh