CVE-2025-13987: 
WordPress vulnerability analysis and mitigation

CVE-2025-13987 is a Cross-Site Request Forgery (CSRF) vulnerability in the Purchase and Expense Manager plugin for WordPress, affecting all versions up to and including 1.1.2. The flaw allows unauthenticated attackers to delete arbitrary purchase records by tricking a site administrator into clicking a malicious link. It was published on December 12, 2025, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is missing nonce validation on the sup_pt_handle_deletion function within the plugin (CWE-352: Cross-Site Request Forgery). Because the function does not verify a WordPress nonce before processing deletion requests, an attacker can craft a forged HTTP request that, when triggered by an authenticated administrator, causes the server to delete arbitrary purchase records without the administrator's intent. Exploitation requires social engineering — the attacker must lure a logged-in administrator to visit a malicious page or click a crafted link. The vulnerable code is visible in the plugin's source at line 604 of purchase-and-expense-manager.php (Wordfence, WordPress Trac).

Successful exploitation allows an unauthenticated attacker to permanently delete arbitrary purchase records from the affected WordPress site's database, resulting in loss of financial data integrity. The impact is limited to integrity (no confidentiality or availability impact), but deletion of purchase or expense records could cause significant business disruption for organizations relying on the plugin for financial tracking. There is no evidence of lateral movement potential or sensitive data exposure beyond the targeted record deletion (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13987. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, tricking a site administrator into performing an action — which limits opportunistic exploitation (Feedly).

1. Reconnaissance: Identify WordPress sites running the Purchase and Expense Manager plugin version 1.1.2 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious request: Construct a forged HTTP GET or POST request targeting the sup_pt_handle_deletion function with a target purchase record ID as a parameter (e.g., https://victim-site.com/wp-admin/admin-post.php?action=sup_pt_handle_deletion&id=<record_id>).
3. Social engineering: Embed the forged request URL in a phishing email, malicious webpage (e.g., as an <img> tag or hidden form with auto-submit), or other lure targeting the site administrator.
4. Trigger deletion: When the authenticated administrator visits the attacker-controlled page or clicks the link, their browser automatically sends the forged request with their session cookies, causing the server to delete the specified purchase record without nonce verification (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing unexpected requests to admin-post.php or similar admin endpoints with action=sup_pt_handle_deletion parameters from unusual referrer URLs or external domains.
• Database: Unexplained deletion of purchase or expense records in the plugin's database tables, particularly if no corresponding administrator action was intentionally performed.
• Network: HTTP requests to WordPress admin endpoints originating from external or unfamiliar IP addresses, especially with referrer headers pointing to non-site domains.

Users should update the Purchase and Expense Manager plugin to a version beyond 1.1.2, which includes proper nonce validation on the sup_pt_handle_deletion function. As an interim workaround, administrators should exercise caution when clicking links in emails or visiting untrusted websites while logged into their WordPress admin panel. Restricting access to WordPress admin endpoints via IP allowlisting or a web application firewall (WAF) can also reduce exposure (Wordfence).