CVE-2025-9049 PUBLISHED

Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover

Assigner: Wordfence
Reserved: 14.08.2025 Published: 05.09.2026 Updated: 05.09.2026

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor scriptsbundle
Product Nokri – Job Board WordPress Theme
Versions Default: unaffected
  • affected from 0 to 1.6.4 (incl.)

Credits

  • Tonn finder

References

Problem Types

  • CWE-862 Missing Authorization CWE