CVE-2025-13990: CSRF in Mamurjor Employee Info WordPress Plugin

The CSRF vulnerability in Mamurjor Employee Info allows an attacker to execute unauthorized actions on a WordPress site if a site administrator is tricked into clicking a malicious link. Specifically, an attacker could create, update, or delete employee records, departments, designations, salary grades, education records, and salary payments. This could lead to data breaches, unauthorized modifications to payroll systems, and potential financial fraud. The impact is amplified if the WordPress site manages sensitive employee data, as the attacker could gain control over critical information and potentially impersonate administrators.

1. Reserved2025-12-03
2. Published2026-01-07
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-13990 is to upgrade to a patched version of the Mamurjor Employee Info plugin as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. One approach is to restrict access to administrative functions requiring authentication and implement strict input validation. Web Application Firewalls (WAFs) can be configured to detect and block malicious CSRF requests. Additionally, educate administrators about the risks of clicking on untrusted links and opening suspicious emails. After upgrade, confirm by attempting to create/modify an employee record via the plugin's admin interface and verifying that the action requires proper authentication.