{"id":"CVE-2026-62142","published":"2026-10-08T13:17:18.553","lastModified":"2026-10-08T17:24:11.230","description":"Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-2fa/vulnerability/wordpress-wp-2fa-plugin-4-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A Cross-Site Request Forgery (CSRF) vulnerability exists in Melapress WP 2FA from version n/a through 4.1.0, allowing attackers to forge requests and potentially perform unauthorized actions on behalf of users.","exploitability":"Exploitation is relatively straightforward as it requires the victim to be logged in and tricked into performing an action on the attacker's behalf. Precondition is that the victim must be using the affected version of the plugin.","blast_radius":"If exploited, the impact could be high, as it allows attackers to perform actions on behalf of the user, potentially leading to data loss or unauthorized access.","remediation":"Disable the affected feature or upgrade to the latest version of the plugin, which is not specified in the description. Follow the specific vendor advisory for the exact version.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["csrf","wp-plugin","auth-bypass","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:43:53.968Z"}}