CVE-2025-9049: Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokriaccountmemberpermissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. They can then create Subscriber users with employer account member permissions.
What is the impact after exploitation?
The attacker can use the employer account member permissions to change the email address of any WordPress user, including an Administrator. This can enable takeover of administrator accounts and lead to high-impact compromise of confidentiality, integrity, and availability.
Which versions are affected?
All Nokri – Job Board WordPress Theme versions up to and including 1.6.4 are affected.