CVE-2025-9049
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.
Risk Assessment
The risk includes privilege escalation and takeover of administrator accounts, potentially leading to full compromise of the WordPress site.
Recommendation
It is recommended to immediately update the Nokri theme to a version newer than 1.6.4 and review user permissions.
Other vulnerabilities in Nokri Job Board WordPress Theme
Original NVD description (English source)
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS