CVE-2025-13990 is a CSRF vulnerability in the Mamurjor Employee Info WordPress plugin affecting all versions up to 1.0.0. The issue arises from missing nonce validation on administrative functions, enabling attackers to forge requests that manipulate employee records, departments, designations, salary grades, education records, and salary payments if a site administrator is tricked into executing the malicious request. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity. No patch or remediation guidance is currently provided, and the plugin is not a cloud service.

An attacker can cause an authenticated administrator to unknowingly perform unauthorized actions such as creating, updating, or deleting sensitive employee information within the plugin. This can lead to data integrity issues but does not directly impact confidentiality or availability according to the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when interacting with untrusted links or content that could trigger administrative actions in the plugin. Applying strict access controls and limiting administrator exposure to untrusted content may reduce risk.