What is the CVSS score of CVE-2026-3191?

CVE-2026-3191 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3191

EUVD-2026-17367 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-31 Wordfence

WordPress CSRF

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 11:45 euvd

EUVD-2026-17367

Analysis Generated

Mar 31, 2026 - 11:45 vuln.today

CVE Published

Mar 31, 2026 - 11:18 nvd

MEDIUM 5.4

DescriptionCVE.org

The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12. This is due to missing or incorrect nonce validation on the 'minify_html_menu_options' function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

The Minify HTML WordPress plugin (versions up to 2.1.12) contains a Cross-Site Request Forgery (CSRF) vulnerability in the 'minify_html_menu_options' function due to missing nonce validation, allowing unauthenticated attackers to modify plugin settings if a site administrator is tricked into clicking a malicious link. The attack requires user interaction (UI:R) but can degrade site availability or integrity by altering minification behavior. No public exploit code or active exploitation has been confirmed, though the vulnerability is tracked by CISA-recognized security researchers.

Technical ContextAI

The Minify HTML plugin (CPE: cpe:2.3:a:teckel:minify_html:*:*:*:*:*:*:*:*) implements WordPress admin settings via the 'minify_html_menu_options' function without proper nonce (number used once) token validation. WordPress nonces are cryptographic tokens that prevent CSRF by ensuring state-changing requests originate from legitimate in-browser forms on the site. CWE-352 (Cross-Site Request Forgery) occurs when this validation is absent or bypassed. An attacker crafts a forged HTML form or link that, when clicked by an authenticated administrator, sends a request to modify plugin settings without the administrator's knowledge, since the browser automatically includes session cookies in cross-origin requests.

RemediationAI

Update the Minify HTML plugin to the patched version released after 2.1.12 as documented in the upstream fix commit 3486011 at plugins.trac.wordpress.org/changeset/3486011/minify-html-markup. Site administrators should immediately check for available updates in their WordPress admin dashboard and apply them. If an update is not yet available, temporarily deactivate the plugin until a patched version is released, or restrict admin dashboard access to trusted users only via .htaccess or equivalent firewall rules. Consult the Wordfence vulnerability intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/fe14b92b-1784-4083-9b9f-23d7f69a3215 for additional mitigation guidance.