CVE-2025-13987

Name of the Vulnerable Software and Affected Versions Purchase and Expense Manager versions prior to 1.1.3

Description Cross-Site Request Forgery occurs due to missing nonce validation in the sup pt handle deletion() function. A nonce is a unique token used to protect against forged requests. This flaw allows unauthenticated attackers to delete arbitrary purchase records by tricking a site administrator into clicking a malicious link.

Recommendations Update the plugin to a version later than 1.1.2. As a temporary workaround, restrict access to the sup pt handle deletion() function until the update is applied.