CVE-2026-3191 is a CSRF vulnerability in the teckel Minify HTML WordPress plugin affecting all versions up to 2.1.12. The issue stems from missing or incorrect nonce validation on the 'minify_html_menu_options' function, enabling attackers to forge requests that update plugin settings without authentication, contingent on administrator interaction. The vulnerability has a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. No known exploits in the wild or patches have been reported.

An attacker can cause an authenticated administrator to unknowingly change plugin settings via a forged request, potentially leading to integrity and availability impacts on the affected WordPress site. There is no direct confidentiality impact. The vulnerability requires user interaction (administrator clicking a crafted link) and does not allow remote code execution or privilege escalation by itself.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking suspicious links and consider restricting administrative access or using additional CSRF protections such as security plugins that enforce nonce validation. Monitor vendor channels for updates and apply patches promptly once released.