CVE-2026-3191 in Minify HTML Plugin

Resumen (Inglés)

The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12. This is due to missing or incorrect nonce validation on the 'minify_html_menu_options' function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Responsable

Wordfence

Reservar

2026-02-25

Divulgación

2026-03-31

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
354372	teckel Minify HTML Plugin Setting minify_html_menu_options falsificación de solicitudes en sitios cruzados	352	No está definido	Arreglo oficial	CVE-2026-3191

Fuentes

• MITRE
• NVD
• CVE Details