Autoptimize CVE-2026-3220

Exploitation requires that the target site runs a vulnerable version of Autoptimize (<3.1.15), Clearfy Cache (<2.4.2), or Speed Optimizer (<7.7.9) with the HTML minification feature enabled - that feature is the vulnerable code path, so sites with HTML minify disabled are not exposed. The attacker must supply input that reaches the minifier and must format it to match the predictable replacement-hash placeholder pattern (feasible precisely because the hash is predictable and the restoration regex is abusable). No authentication is required (PR:N), but per CVSS UI:R the payload only fires when a victim loads the affected page, so realistic impact depends on a privileged user (e.g., admin) viewing the poisoned output; SSVC Automatable:no reflects that this interaction dependency prevents fully automated mass exploitation.

Signals are mixed and should be weighed together. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R) with C:H/I:H/A:H, reflecting an unauthenticated, low-complexity network vector that requires victim interaction (loading the poisoned page). Against that, EPSS is very low (0.03%, 8th percentile) and CISA SSVC rates it Exploitation: poc, Automatable: no, Technical Impact: total - meaning a working concept exists but mass, automated exploitation is not expected, though a successful hit is fully impactful. The NVD impact metrics (C:H/I:H/A:H) are notably aggressive for a stored XSS; in practice XSS impact is often Low unless it lands in a privileged/admin session, so treat the 'total' rating as a plausible worst case (e.g., admin session theft leading to site takeover) rather than guaranteed on every install. This is a real, patch-now issue for exposed WordPress sites given unauthenticated access and public POC, but the low EPSS and non-automatable SSVC suggest opportunistic/targeted rather than worm-like exploitation. Note the tension: CVSS UI:R plus SSVC Automatable:no both indicate a victim-interaction dependency that tempers the otherwise 'unauthenticated critical' framing.

An attacker submits crafted content to a page that the site later serves through the plugin's HTML minifier, formatting the payload to match the predictable placeholder hash so it survives minification and lands inside an HTML attribute. When a visitor - ideally a logged-in administrator - loads the cached/minified page, the injected attributes execute attacker-controlled script in their browser, enabling session/cookie theft or admin actions. Public POC exploit code from WPScan lowers the barrier, though the CVSS UI:R requirement means a victim must view the poisoned page.