EUVD-2026-94932
GHSA-7hgv-cj45-jw9m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CSRF needs no attacker privileges (PR:N) but requires tricking an authenticated user (UI:R); a forged 2FA settings change is primarily an integrity impact (I:H), with limited confidentiality and no clear availability effect absent endpoint detail.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0.
AnalysisAI
Cross-site request forgery in the Melapress WP 2FA WordPress plugin, affecting all versions through 4.1.0, allows an attacker to make a logged-in privileged WordPress user - typically an administrator with access to the two-factor authentication settings - perform unintended state-changing WP 2FA actions by tricking them into visiting a malicious page or link while their session is active. The input CVSS 3.1 vector scores 8.8 (High, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but an independent reassessment places integrity impact as the dominant concern (C:L/I:H/A:N), since exploitation is wholly dependent on a victim who is both authenticated and successfully lured into interaction (UI:R); no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated, privileged WordPress user (typically an administrator with access to WP 2FA settings) to be logged in and then tricked into interacting with attacker-controlled content (UI:R) - a malicious link, page, or auto-submitting form. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields an 8.8 'High' score, but several signals temper the real-world urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary action is to update the Melapress WP 2FA plugin to the latest available release newer than 4.1.0, since 4.1.0 is the upper bound of the affected range, and to verify the exact fixed version on the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-2fa/vulnerability/wordpress-wp-2fa-plugin-4-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve) before closing the finding - patch status is not independently confirmed in the supplied data, and no specific fixed version number should be assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every WordPress instance running the Melapress WP 2FA plugin and confirm which sit at affected versions (all releases through 4.1.0); where the plugin is not operationally required, deactivate and remove it immediately, and where it is required, reduce exposure by restricting /wp-admin, wp-login.php and admin-ajax.php to trusted IP ranges or VPN, enforcing re-authentication and short session lifetimes for administrators, and adding a web application firewall rule that blocks cross-origin state-changing requests to the plugin's settings endpoints when the Origin/Referer header is absent or mismatched. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
TOTP replay in the WP 2FA WordPress plugin (versions before 4.1.0) allows an attacker who already knows an account's pas
Two-factor authentication bypass in the WP 2FA WordPress plugin before 4.1.0 allows an attacker who possesses a valid us
Account takeover in the WP 2FA WordPress plugin (all versions before 3.1.1.2) is achievable by any attacker who has obta
The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin
The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could b
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP 2FA w
Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.2.0. Rated medium severity (CVSS
The WP 2FA - Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in
The WP 2FA - Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Refere
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today