CVE-2026-62142: Cross-Site Request Forgery (CSRF) in Melapress WP 2FA

The Melapress WP 2FA plugin versions prior to 4.2.0 contain a CSRF vulnerability that could allow an attacker to execute unauthorized actions on behalf of an authenticated user. The vulnerability affects all versions from initial release through 4.1.0. The CVSS 3.1 base score is 8.8, indicating a high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. No vendor advisory or patch links are provided in the input data.

Successful exploitation of this CSRF vulnerability could lead to unauthorized changes or actions within the WP 2FA plugin context, potentially compromising the two-factor authentication mechanism and affecting site security. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted links and consider disabling or limiting the use of the affected plugin versions. Monitor the vendor's communications for updates on patches or official mitigations.