CVE-2026-1392 is a Cross-Site Request Forgery vulnerability in the SR WP Minify HTML plugin for WordPress. The issue arises because the sr_minify_html_theme() function lacks nonce validation, which is a security measure to prevent unauthorized requests. As a result, attackers can craft forged requests that, when executed by an authenticated administrator, can modify plugin settings without proper authorization. This vulnerability affects all versions up to and including 2.1 of the plugin. The CVSS v3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed.

An attacker can cause an authenticated site administrator to unknowingly change the plugin's settings by tricking them into clicking a malicious link or performing a specific action. While this does not directly lead to data confidentiality loss or denial of service, it can result in unauthorized configuration changes that may affect site behavior or security posture.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links or content that could trigger plugin setting changes. Monitoring for updates from the plugin vendor or WordPress security channels is recommended to apply any forthcoming patches promptly.