CVE-2026-18550: Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter
The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword() function, which allows empty attacker-supplied reset tokens to match empty or unset sbpasswordforgettoken user meta values. This makes it possible for unauthenticated attackers to reset the password of any user, including administrators, and gain access to their account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nokri - Job Board WordPress Themeto a version that resolves this vulnerability.Fixed in 1.6.6
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. No existing WordPress account, privileges, or user interaction are required.
Which accounts are at risk?
Any user account whose sb_password_forget_token meta value is empty or unset may be vulnerable to password reset and takeover. This includes administrator accounts.
What condition makes the password reset validation bypass possible?
The vulnerable nokri_reset_password() function accepts an attacker-supplied empty token when it matches an empty or unset sb_password_forget_token user meta value. The issue affects Nokri versions through 1.6.6.