Melapress WP 2FA: Cross-Site Request Forgery in WordPress plugin
Summary
The WP 2FA WordPress plugin (two-factor authentication) contains a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). An attacker can create a malicious link or page that makes a logged-in user unknowingly perform actions in the plugin, which may include changes to 2FA settings. Exploitation requires that a logged-in user, such as an administrator, is lured to the attacker's content.
Affected
- WP 2FA WordPress plugin up to and including 4.1.0 (per CNA and Patchstack)
- Some databases list the range as below 4.2.0; treat all versions below 4.2.x as affected
Fixed in
- Update to 4.2.0 or later (minimum per CNA and Patchstack)
- Melapress's current release 4.2.1 (14 October 2026) includes a CSRF security fix; the exact CVE-to-release mapping is not confirmed by the vendor
Workaround
- No vendor-documented workaround found. Updating is the recommended fix.
- General precaution: log out of WordPress admin when not in use and avoid browsing other sites while logged in.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- EPSS 0.0013.
- No public proof of concept found.
Our recommendation
- Update the WP 2FA plugin to the latest version (at least 4.2.0, currently 4.2.1).
- Check all WordPress sites for WP 2FA versions 4.1.0 or earlier.
- Review 2FA settings and admin accounts for unexpected changes after updating.
- Avoid using wp-admin in the same browser session as general web browsing.
- Note that versions 4.1.0 and earlier have other known 2FA bypass and user-removal issues, which further supports updating.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack: WP 2FA vulnerability entry patchstack.com
- Patchstack: WP 2FA vulnerabilities overview patchstack.com
- Melapress WP 2FA release notes melapress.com
- Hol.org: CVE-2026-62142 hol.org
- Offseq: CVE-2026-62142 radar.offseq.com
- Vulners: RAPID7 CVE-2026-62142 (EPSS) vulners.com
- Strix: CVE-2026-62142 www.strix.ai
- WPScan: WP 2FA plugin wpscan.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:13.
Original description (NVD)
Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.