CVE-2025-13987 describes a CSRF vulnerability in the codnloc Purchase and Expense Manager WordPress plugin versions up to 1.1.2. The issue arises from the absence of nonce validation in the 'sup_pt_handle_deletion' function, enabling attackers to craft malicious requests that, when executed by an authenticated administrator, result in deletion of purchase records without proper authorization checks. This vulnerability requires user interaction (UI:R) but no privileges (PR:N) and can be exploited remotely (AV:N).

An attacker can cause deletion of arbitrary purchase records by tricking an authenticated site administrator into clicking a malicious link or performing a specific action. This leads to integrity loss of purchase data but does not affect confidentiality or availability. The impact is limited to unauthorized modification (integrity) of purchase records.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, administrators should avoid clicking on untrusted links while logged into the WordPress admin interface. Implementing manual nonce validation or disabling the affected plugin until a fix is released can reduce risk.