CVE-2025-13990

The Mamurjor Employee Info plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to create, update, or delete employee records, departments, designations, salary grades, education records, and salary payments via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L10
• https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L30
• https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L47
• https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L10
• https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L30
• https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L47
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8e323b87-7b2e-4e5c-94a4-a4a0712f50ba?source=cve

Published

Jan 7, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-13985Incorrect Authorization vulnerability in Drupal Entity Share…5.3
• CVE-2025-13986Authentication Bypass Using an Alternate Path or Channel vul…4.2
• CVE-2025-13987The Purchase and Expense Manager plugin for WordPress is vul…4.3
• CVE-2025-13988The 评论小秘书 plugin for WordPress is vulnerable to Reflected Cr…6.1
• CVE-2025-13989The WP Dropzone plugin for WordPress is vulnerable to Stored…6.4
• CVE-2025-1399Out-of-bounds Read vulnerability in unpack_response (session…3.1
• CVE-2025-13992Side-channel information leakage in Navigation and Loading i…4.7
• CVE-2025-13993The MailerLite – Signup forms (official) plugin for WordPres…5.5
• CVE-2025-13995IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 could …5
• CVE-2025-13997The King Addons for Elementor – 4,000+ ready Elementor secti…5.3
• CVE-2025-13999The HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 &…7.2
• CVE-2025-1400Out-of-bounds Read vulnerability in unpack_response (conn.c)…3.1