CVE-2026-66691

The Nokri plugin versions up to 1.6.6 contain an unauthenticated Broken Access Control vulnerability. This means an attacker without logging in can access functions or data that should be protected.

An unauthorized user can access sensitive functions or data, potentially leading to confidentiality or integrity breaches of the site. This may also enable further attacks such as content modification or data theft.

Update the Nokri plugin to the latest version that includes the fix. If not available, restrict access to the admin panel and sensitive functions with additional security measures such as a web application firewall.