EUVD-2026-17367Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12. This is due to missing or incorrect nonce validation on the 'minify_html_menu_options' function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
The Minify HTML WordPress plugin (versions up to 2.1.12) contains a Cross-Site Request Forgery (CSRF) vulnerability in the 'minify_html_menu_options' function due to missing nonce validation, allowing unauthenticated attackers to modify plugin settings if a site administrator is tricked into clicking a malicious link. The attack requires user interaction (UI:R) but can degrade site availability or integrity by altering minification behavior. No public exploit code or active exploitation has been confirmed, though the vulnerability is tracked by CISA-recognized security researchers.
Technical ContextAI
The Minify HTML plugin (CPE: cpe:2.3:a:teckel:minify_html:*:*:*:*:*:*:*:*) implements WordPress admin settings via the 'minify_html_menu_options' function without proper nonce (number used once) token validation. WordPress nonces are cryptographic tokens that prevent CSRF by ensuring state-changing requests originate from legitimate in-browser forms on the site. CWE-352 (Cross-Site Request Forgery) occurs when this validation is absent or bypassed. An attacker crafts a forged HTML form or link that, when clicked by an authenticated administrator, sends a request to modify plugin settings without the administrator's knowledge, since the browser automatically includes session cookies in cross-origin requests.
RemediationAI
Update the Minify HTML plugin to the patched version released after 2.1.12 as documented in the upstream fix commit 3486011 at plugins.trac.wordpress.org/changeset/3486011/minify-html-markup. Site administrators should immediately check for available updates in their WordPress admin dashboard and apply them. If an update is not yet available, temporarily deactivate the plugin until a patched version is released, or restrict admin dashboard access to trusted users only via .htaccess or equivalent firewall rules. Consult the Wordfence vulnerability intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/fe14b92b-1784-4083-9b9f-23d7f69a3215 for additional mitigation guidance.
More in Minify Html
View allSame weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today