CVE-2026-62142— WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability
Quick assessment
Affected
Melapress WP 2FA
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Melapress WP 2FA (wp-2fa) 插件中存在跨站请求伪造（CSRF）漏洞。该漏洞允许攻击者利用跨站请求伪造。此问题影响 WP 2FA 插件的版本范围：从 n/a 到 4.1.0。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-62142
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-62142
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-62142
请登录查看更多情报信息。
Other References for CVE-2026-62142 (1)
IV. Related Vulnerabilities
Same product: WP 2FA
-
CVE-2026-103514
WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP C -
CVE-2026-15372
WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passke -
CVE-2026-12988
WP 2FA < 3.1.1.2 - Account Takeover via 2FA Setup Email Bind -
CVE-2025-12628
WP 2FA < 3.0.0 - Second Factor Bypass -
CVE-2022-44587
WordPress WP 2FA plugin <= 2.6.3 - Sensitive Data Exposure v
Same vendor: Melapress
-
CVE-2026-96827
WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Inject -
CVE-2026-62085
WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vu -
CVE-2026-65512
WordPress WP Activity Log and WP Activity Log Premium plugin -
CVE-2026-56005
WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scr -
CVE-2026-54806
WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Inj
Same weakness: CWE-352
-
CVE-2026-106611
WordPress Forminator plugin <= 1.57.3 - Cross Site Request F -
CVE-2026-102784
Joomla Extension - balbooa.com - CSRF in language installati -
CVE-2026-66479
WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS -
CVE-2026-45161
wger: trainer_login accepts GET - CSRF bypass enables forced -
CVE-2026-106216
Chrome Android CSRF漏洞（<155.0.8059.39）
V. Comments for CVE-2026-62142
No comments yet