CVE-2026-3191: Minify HTML WordPress Plugin CSRF Flaw

CVE-2026-3191 Overview

The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 2.1.12. This vulnerability exists due to missing or incorrect nonce validation on the minify_html_menu_options function. This flaw makes it possible for unauthenticated attackers to update plugin settings via a forged request, provided they can trick a site administrator into performing an action such as clicking on a malicious link.

Critical Impact

Unauthenticated attackers can manipulate plugin configuration settings through social engineering, potentially disrupting site functionality or enabling further attacks by modifying HTML minification behavior.

Affected Products

• WordPress Minify HTML Plugin versions up to and including 2.1.12

Discovery Timeline

• 2026-03-31 - CVE-2026-3191 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-3191

Vulnerability Analysis

This Cross-Site Request Forgery vulnerability stems from inadequate request validation in the WordPress Minify HTML plugin's administrative functionality. The minify_html_menu_options function, which handles plugin configuration changes, fails to properly implement WordPress nonce verification. Nonces (number used once) are security tokens that WordPress uses to verify that requests originate from legitimate administrative actions rather than malicious third-party sites.

Without proper nonce validation, the plugin cannot distinguish between authentic configuration requests made by authenticated administrators and forged requests initiated by attackers. This allows an attacker to craft a malicious webpage or link that, when visited by a logged-in WordPress administrator, will automatically submit configuration changes to the vulnerable plugin.

Root Cause

The root cause of this vulnerability is the absence or improper implementation of nonce validation in the minify_html_menu_options function located in minify-html.php at line 139. WordPress provides built-in functions such as wp_verify_nonce() and check_admin_referer() to protect against CSRF attacks, but these safeguards were either missing or incorrectly implemented in the affected versions.

Attack Vector

The attack requires network access and user interaction to execute. An attacker would craft a malicious HTML page containing a hidden form that targets the vulnerable plugin's settings endpoint. When an authenticated WordPress administrator with sufficient privileges visits the attacker's page (via a phishing email, compromised website, or social engineering), the hidden form automatically submits a request to the WordPress site, changing plugin settings without the administrator's knowledge or consent.

The vulnerability in the minify_html_menu_options function allows attackers to modify plugin settings because the function processes form submissions without verifying a valid nonce token. This means any request that reaches this function will be processed as legitimate, regardless of its origin.

Detection Methods for CVE-2026-3191

Indicators of Compromise

• Unexpected changes to Minify HTML plugin settings without administrator action
• HTTP POST requests to WordPress admin endpoints containing modified plugin configuration parameters from external referrers
• Administrator reports of clicking suspicious links followed by altered site behavior
• Web server logs showing form submissions to the plugin settings page with unusual or missing referrer headers

Detection Strategies

• Monitor WordPress admin activity logs for unexpected plugin configuration changes, particularly to the Minify HTML plugin
• Implement referrer header validation at the web server level to flag requests to admin endpoints originating from external domains
• Deploy Web Application Firewall (WAF) rules to detect and block CSRF attack patterns targeting WordPress administrative functions
• Review access logs for clusters of admin-ajax.php or options.php requests that correlate with administrator browsing external websites

Monitoring Recommendations

• Enable WordPress security plugins that log administrative actions and alert on configuration changes
• Configure SIEM rules to correlate WordPress admin session activity with external URL access patterns
• Regularly audit Minify HTML plugin settings to ensure they match expected configurations
• Monitor for newly created or modified files in the plugin directory that could indicate post-exploitation activity

How to Mitigate CVE-2026-3191

Immediate Actions Required

• Update the Minify HTML plugin to a patched version beyond 2.1.12 immediately
• Review current plugin settings to ensure no unauthorized modifications have been made
• Advise WordPress administrators to avoid clicking untrusted links while logged into the WordPress dashboard
• Consider temporarily deactivating the plugin until the update can be applied if immediate patching is not possible

Patch Information

A security patch addressing this vulnerability has been released. The fix can be reviewed in the WordPress Minify HTML Changeset. The patch implements proper nonce validation on the minify_html_menu_options function to ensure that configuration changes can only be made through legitimate administrative requests.

Additional vulnerability details are available through Wordfence Vulnerability Intelligence.

Workarounds

• Implement a Web Application Firewall (WAF) with CSRF protection rules to filter malicious requests
• Use browser extensions that block cross-site form submissions for administrators
• Log out of WordPress administrative sessions when browsing other websites
• Configure Content Security Policy headers to restrict form action targets
• Restrict administrator access to trusted IP addresses to limit the attack surface

WordPress administrators should ensure proper nonce validation is enforced across all plugins. The standard WordPress approach involves adding nonce fields to forms using wp_nonce_field() and validating them server-side with wp_verify_nonce() or check_admin_referer() before processing any configuration changes.