EUVD-2026-14191
GHSA-w4gr-x4qr-j3xw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The SR WP Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing nonce validation on the sr_minify_html_theme() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
The SR WP Minify HTML plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce validation in the sr_minify_html_theme() function, affecting all versions up to and including 2.1. An unauthenticated attacker can exploit this vulnerability to modify plugin settings by tricking a site administrator into clicking a malicious link, potentially allowing unauthorized changes to site minification configuration. While the CVSS score of 4.3 is moderate and no KEV status or active exploitation has been confirmed, the vulnerability remains exploitable against WordPress installations with this plugin active.
Technical ContextAI
This vulnerability is rooted in CWE-352: Cross-Site Request Forgery (CSRF), a web application security flaw where an attacker can execute unwanted actions on behalf of an authenticated user without their knowledge. The SR WP Minify HTML plugin, identified via CPE cpe:2.3:a:superrishi:sr_wp_minify_html:*:*:*:*:*:*:*:*, fails to implement WordPress's standard nonce validation mechanism in the sr_minify_html_theme() function. The plugin accepts and processes requests that modify settings (such as HTML minification parameters) without verifying a cryptographic nonce token, which is the standard defense against CSRF in WordPress. This is particularly critical for administrative functions where settings changes should be validated to originate from legitimate, in-session requests rather than cross-origin forgery attempts.
RemediationAI
WordPress site administrators should immediately update the SR WP Minify HTML plugin to a patched version beyond 2.1 if such a release is available, or disable the plugin entirely until a fix is released. The fix requires the plugin developer to implement proper WordPress nonce validation using wp_verify_nonce() on the sr_minify_html_theme() function and ensure all AJAX and form submissions include appropriate nonce tokens. Until a patched version is available, administrators can implement temporary mitigation by restricting access to WordPress administrative pages via Web Application Firewall rules or network-level restrictions, and by educating administrators to avoid clicking suspicious links. Monitor the official plugin repository and Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/728aa62d-4853-4f55-9b77-82dfa6525b8a?source=cve) for patch availability announcements.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today