A Cross‑Site Request Forgery vulnerability exists in the Melapress WP 2FA plugin for versions up through 4.1.0. The flaw allows an attacker to cause a logged‑in user to submit forged requests that change plugin settings or otherwise perform state‑changing operations normally protected by authentication. This maps to CWE‑352 and can compromise the integrity of the WordPress site by enabling unauthorized configuration changes.

WordPress sites that have installed the Melapress WP 2FA plugin 4.1.0 or older. The vulnerability applies to every installation of the plugin up to the cited version, regardless of the underlying WordPress core version.

The CVSS score of 8.8 classifies the vulnerability as high severity. The EPSS score is unavailable and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a CSRF request originating from a malicious website or email, requiring the victim to be authenticated and have sufficient privileges on the target site. Because the attacker does not rely on server‑side exploitation, the only prerequisite is a user session. The risk level is substantial for sites that rely on the plugin for two‑factor authentication, especially where administrators or privileged users frequently remain logged in.