Description

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the `nokri_reset_password()` function, which allows empty attacker-supplied reset tokens to match empty or unset `sb_password_forget_token` user meta values. This makes it possible for unauthenticated attackers to reset the password of any user, including administrators, and gain access to their account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-01T12:17:35.920Z",
  "pubdate": "2026-09-01T12:17:35.920Z",
  "executiveSummary": "The Nokri - Job Board WordPress theme is susceptible to an unauthenticated privilege escalation vulnerability. The flaw exists within the password reset mechanism, specifically within the nokri_reset_password() function. By exploiting improper validation logic regarding password reset tokens, an unauthenticated attacker can manipulate the password reset flow to modify the credentials of any registered user, including administrative accounts. This constitutes a critical security risk, as it allows complete account takeover without requiring prior access or interaction with the target user. Successful exploitation provides the attacker with full unauthorized control over the targeted user profile. Because this vulnerability can be leveraged against high-privileged accounts, it poses a severe threat to the integrity and confidentiality of the WordPress installation and its associated data. No special privileges are required, and the attack can be executed remotely over the network.",
  "technicalDetails": "The vulnerability originates from a logic flaw within the nokri_reset_password() function, which is responsible for processing password reset requests. The function fails to implement sufficient verification of the reset token supplied by the user. Specifically, the implementation allows for an empty or null attacker-supplied token to successfully match against a user account where the 'sb_password_forget_token' meta value is either empty or unset.\nUnder normal circumstances, the 'sb_password_forget_token' should only be populated when a legitimate password reset request is initiated, and it should contain a cryptographically secure, unique value. However, the code logic does not enforce a strict comparison or ensure that a token must exist before allowing the reset to proceed. When an attacker submits a password reset request for a target username and provides an empty value for the token parameter, the function erroneously validates the request.\nThe exploitation flow proceeds as follows: 1) The attacker targets a specific user account, such as an administrator account, using their known username or email address. 2) The attacker triggers the password reset mechanism provided by the Nokri theme. 3) The attacker intercepts or crafts a request where the reset token parameter is left empty or omitted. 4) The nokri_reset_password() function executes a database query to retrieve the user's 'sb_password_forget_token' meta value. If this value is empty (which is the default state for accounts that have never requested a reset), the comparison between the attacker-supplied empty string and the database value returns a match due to loose validation or a failure to distinguish between a missing token and an empty string.\nOnce the token is validated, the theme grants the attacker the ability to define a new password for the target account. Because this process bypasses authentication entirely, the attacker can effectively reset the password of any user in the WordPress database. Once the new password is set, the attacker can authenticate as that user, resulting in a full account takeover. The vulnerability affects all versions of the Nokri - Job Board WordPress theme up to, and including, 1.6.6. It is remotely exploitable without authentication, placing the entire WordPress user base at risk of compromise."
}