CVE-2025-9049

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://themeforest.net/item/nokri-job-board-wordpress-theme/22677241#item-description__nokri-theme-change-logs
https://www.wordfence.com/threat-intel/vulnerabilities/id/e079e886-70a5-4188-ad99-96fc37651ed0?source=cve

Configurations

No configuration.

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El tema Nokri - Job Board para WordPress es vulnerable a la modificación no autorizada de datos debido a la falta de verificación de capacidad en la función ’nokri_account_member_permissions’ en todas las versiones hasta la versión 1.6.4 incluida. Esto permite que atacantes autenticados con acceso de nivel Suscriptor o superior agreguen nuevos usuarios Suscriptor con permisos de miembro de cuenta de empleador, quienes a su vez pueden escalar privilegios actualizando la dirección de correo electrónico de cualquier usuario, incluidos los usuarios Administrador.

Information

Published : 2026-09-05 12:16

Updated : 2026-10-19 22:10

NVD link : CVE-2025-9049

Mitre link : CVE-2025-9049

CVE.ORG link : CVE-2025-9049

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-9049", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9049", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-07T11:03:38.573775Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "scriptsbundle", "product": "Nokri \u2013 Job Board WordPress Theme", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.4"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-05T12:16:46.653", "references": [{"url": "https://themeforest.net/item/nokri-job-board-wordpress-theme/22677241#item-description__nokri-theme-change-logs", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e079e886-70a5-4188-ad99-96fc37651ed0?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The Nokri \u2013 Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users."}, {"lang": "es", "value": "El tema Nokri - Job Board para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a la falta de verificaci\u00f3n de capacidad en la funci\u00f3n \u2019nokri_account_member_permissions\u2019 en todas las versiones hasta la versi\u00f3n 1.6.4 incluida. Esto permite que atacantes autenticados con acceso de nivel Suscriptor o superior agreguen nuevos usuarios Suscriptor con permisos de miembro de cuenta de empleador, quienes a su vez pueden escalar privilegios actualizando la direcci\u00f3n de correo electr\u00f3nico de cualquier usuario, incluidos los usuarios Administrador."}], "lastModified": "2026-10-19T22:10:00.130", "sourceIdentifier": "security@wordfence.com"}