CVE-2025-13990: Mamurjor Employee Info CSRF Vulnerability

CVE-2025-13990 Overview

The Mamurjor Employee Info plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 1.0.0. This vulnerability exists due to missing nonce validation on multiple administrative functions within the plugin. Unauthenticated attackers can exploit this flaw to create, update, or delete employee records, departments, designations, salary grades, education records, and salary payments via forged requests, provided they can trick a site administrator into performing an action such as clicking on a malicious link.

Critical Impact

Attackers can manipulate sensitive employee data including salary information, personal records, and organizational structures without authentication by exploiting missing CSRF protections.

Affected Products

• Mamurjor Employee Info plugin for WordPress versions up to and including 1.0.0

Discovery Timeline

• 2026-01-07 - CVE CVE-2025-13990 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-13990

Vulnerability Analysis

This Cross-Site Request Forgery (CSRF) vulnerability (CWE-352) allows unauthenticated attackers to perform unauthorized administrative actions on behalf of authenticated WordPress administrators. The vulnerability affects the core administrative functionality of the Mamurjor Employee Info plugin, which is designed to manage employee information within WordPress installations.

The attack requires social engineering to succeed—an attacker must craft a malicious request and convince an authenticated administrator to trigger it, typically by clicking a link or visiting a malicious page while logged into the WordPress admin panel. Once triggered, the forged request executes with the administrator's privileges, enabling unauthorized modifications to employee data.

The impact includes potential data integrity issues where employee records, departments, designations, salary grades, education records, and salary payments can be manipulated. This could lead to operational disruption, payroll fraud scenarios, or data corruption within organizations using this plugin.

Root Cause

The root cause of this vulnerability is the absence of nonce validation on multiple administrative functions within the plugin's admin/admin.php file. WordPress nonces (number used once) are security tokens designed to protect against CSRF attacks by ensuring that form submissions and URL actions originate from legitimate user interactions rather than forged requests.

The vulnerable code paths can be examined in the WordPress plugin repository at Line 10, Line 30, and Line 47. These functions process administrative requests without verifying that the request includes a valid WordPress nonce token.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker would craft a malicious HTML page or link containing forged form submissions targeting the vulnerable administrative endpoints. When an authenticated WordPress administrator visits this malicious content, their browser automatically sends the forged request with their valid session cookies, causing the malicious action to execute with their privileges.

A typical attack scenario involves:

1. The attacker identifies a target WordPress site using the Mamurjor Employee Info plugin
2. The attacker crafts an HTML page containing hidden forms that submit data to the plugin's administrative endpoints
3. The attacker tricks an administrator into visiting the malicious page (via phishing, social media, or other means)
4. The administrator's browser submits the forged requests with their authenticated session
5. The plugin processes the requests and modifies employee data without proper authorization verification

For technical details on the vulnerable code, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-13990

Indicators of Compromise

• Unexpected modifications to employee records, departments, or salary information without corresponding admin activity logs
• Referrer headers in web server logs showing external domains for administrative POST requests
• Reports from administrators about actions they did not perform in the employee management system

Detection Strategies

• Monitor WordPress administrative action logs for employee data modifications that lack corresponding legitimate admin sessions
• Implement web application firewall (WAF) rules to detect CSRF attack patterns targeting WordPress plugins
• Audit plugin versions and flag installations of Mamurjor Employee Info version 1.0.0 or earlier

Monitoring Recommendations

• Enable comprehensive logging for all WordPress administrative actions, particularly those related to employee data management
• Deploy real-time alerting for bulk modifications to employee records outside normal business hours
• Monitor for unusual referrer patterns in requests to WordPress admin endpoints

How to Mitigate CVE-2025-13990

Immediate Actions Required

• Disable the Mamurjor Employee Info plugin until a patched version becomes available
• Audit existing employee data for unauthorized modifications that may have occurred while the vulnerable version was active
• Educate administrators about phishing risks and avoiding clicking suspicious links while logged into WordPress

Patch Information

At the time of publication, the vulnerability affects all versions up to and including 1.0.0. Monitor the WordPress plugin repository and the Wordfence vulnerability database for updates regarding patched versions.

Workarounds

• Implement a Web Application Firewall (WAF) with CSRF protection rules to filter malicious requests
• Restrict administrative access to trusted IP addresses only to reduce the attack surface
• Use browser extensions that enforce same-origin policies and block suspicious cross-site requests

# Example: Restrict WordPress admin access by IP in .htaccess
<Files wp-admin>
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from YOUR_TRUSTED_IP
</Files>