The Minify HTML plugin for WordPress, in all releases up to version 2.1.12, has a missing or incorrect nonce check in the minify_html_menu_options function. This flaw enables a forged request that an administrator may unknowingly submit, thereby changing the plugin’s configuration. The flaw is a classic Cross‑Site Request Forgery (CWE‑352) that results in unauthorized configuration changes, potentially affecting site performance or exposing the site to further attacks.

Any WordPress installation that uses the Minify HTML plugin with a version less than or equal to 2.1.12 is affected. No other vendors or products are listed, and the vulnerable version range stops at 2.1.12, with no additional sub‑versions specified.

The CVSS score of 5.4 indicates a medium severity. Exploitation requires a social‑engineering vector: an attacker must entice a logged‑in administrator to load a crafted URL that triggers the vulnerable function. The EPSS score is not provided, and the vulnerability is not in the CISA Known Exploited Vulnerabilities catalog. Therefore, while the likelihood of a broad, automated attack appears low, the risk to any site with vulnerable plugin remains moderate due to reliance on administrator action.