Description

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-05T12:16:46.653Z",
  "pubdate": "2026-09-05T12:16:46.653Z",
  "executiveSummary": "The Nokri – Job Board WordPress Theme is affected by a critical vulnerability involving improper access control. The root cause is a missing capability check in the 'nokri_account_member_permissions' function, which facilitates unauthorized modification of user account data.\nThis vulnerability allows an authenticated attacker with minimal privileges, such as a Subscriber, to manipulate member permissions within the theme's ecosystem. By successfully exploiting this flaw, an attacker can create new user accounts with employer permissions, which serves as a gateway for further privilege escalation.\nThe ultimate impact involves the ability of a compromised or created account to perform administrative operations, specifically the modification of user email addresses, including those belonging to Administrator accounts. This facilitates account takeovers and complete site compromise.\nThe vulnerability affects all versions of the Nokri theme up to and including version 1.6.4. Exploitation does not require elevated initial privileges, only a standard authenticated user account. Given the potential for total administrative control over the WordPress installation, this flaw carries a high-risk severity rating and requires immediate remediation.",
  "technicalDetails": "The vulnerability resides within the 'nokri_account_member_permissions' function of the Nokri – Job Board WordPress Theme. The function is designed to handle user permission assignments; however, it fails to perform a formal authorization check (such as a 'current_user_can()' call) to verify if the requesting user possesses the administrative rights necessary to alter account settings or add new members.\nThe attack vector involves a standard authenticated user sending a crafted HTTP request that invokes the 'nokri_account_member_permissions' logic. Because the theme does not validate the requester's role, the server processes the input and executes the underlying modification routines as if authorized. An attacker can use this mechanism to inject or modify records in the WordPress 'wp_users' or associated 'wp_usermeta' tables via the theme's administrative backend interfaces.\nThe exploitation flow begins with the attacker establishing a baseline Subscriber account. Once authenticated, the attacker crafts a request aimed at the vulnerable function to register or update an employer-level account member. Once this user is created with elevated employer permissions, the attacker utilizes the theme's administrative functionality—which the theme incorrectly assumes is protected or restricted only to legitimate employers—to interact with other user objects.\nA key technical escalation point occurs because the theme's employer member management system contains a logical flaw that allows the modification of user account details. By targetting an Administrator account and triggering a change in the associated email address, the attacker can then initiate a password reset request via the standard WordPress 'wp-login.php?action=lostpassword' process. Since the attacker controls the email address assigned to the administrator account, they receive the reset token, perform the password change, and achieve full site takeover.\nThe vulnerable component is the theme's proprietary account permission management logic, which operates independently of native WordPress user capability checks. By bypassing these checks, the application exposes critical administrative functionality to low-privilege users. Since this interface is reachable by any logged-in user, the network exposure is restricted only by the requirement of an active session, making it a highly reliable exploit for local authenticated attackers."
}