Mamurjor Employee Info <= 1.0.0 - Cross-Site Request Forgery zu willkürlicher Mitarbeiter- und zugehöriger Datenmanipulation

The CSRF vulnerability in Mamurjor Employee Info allows an attacker to execute unauthorized actions on a WordPress site if a site administrator is tricked into clicking a malicious link. Specifically, an attacker could create, update, or delete employee records, departments, designations, salary grades, education records, and salary payments. This could lead to data breaches, unauthorized modifications to payroll systems, and potential financial fraud. The impact is amplified if the WordPress site manages sensitive employee data, as the attacker could gain control over critical information and potentially impersonate administrators.

WordPress sites utilizing the Mamurjor Employee Info plugin, particularly those managing sensitive employee data or with limited security controls, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise on one site could potentially impact others.

• wordpress / composer / npm:

grep -r 'admin.php' /var/www/html/wp-content/plugins/mamurjor-employee-info/

• wordpress / composer / npm:

wp plugin list --status=inactive | grep mamurjor-employee-info

• wordpress / composer / npm:

wp plugin list | grep mamurjor-employee-info

1. 2026-01-07Disclosure

   disclosure

1. Reserviert2025-12-03
2. Veröffentlicht2026-01-07
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-13990 is to upgrade to a patched version of the Mamurjor Employee Info plugin as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. One approach is to restrict access to administrative functions requiring authentication and implement strict input validation. Web Application Firewalls (WAFs) can be configured to detect and block malicious CSRF requests. Additionally, educate administrators about the risks of clicking on untrusted links and opening suspicious emails. After upgrade, confirm by attempting to create/modify an employee record via the plugin's admin interface and verifying that the action requires proper authentication.