CVE-2025-13990
CSRF in Mamurjor Employee Info Plugin Allows Admin Data Manipulation
Publication date: 2026-01-07
Last updated on: 2026-01-07
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mamurjor | employee_info | to 1.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update or remove the Mamurjor Employee Info plugin if it is installed and is version 1.0.0 or earlier. Additionally, avoid clicking on suspicious links and ensure that site administrators are aware of the risk of Cross-Site Request Forgery attacks. Implementing nonce validation on administrative functions can also help prevent exploitation.
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Mamurjor Employee Info plugin for WordPress, affecting all versions up to and including 1.0.0. It occurs because the plugin lacks nonce validation on multiple administrative functions, allowing an attacker to trick a site administrator into performing unintended actions such as creating, updating, or deleting employee-related records via a forged request.
How can this vulnerability impact me? :
An attacker can exploit this vulnerability to manipulate employee records, departments, designations, salary grades, education records, and salary payments without authentication by tricking an administrator into clicking a malicious link. This could lead to unauthorized changes in sensitive employee data, potentially causing data integrity issues and operational disruptions.