CVE-2025-9049
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.25%
- CWE
- CWE-862
- Published
- 2026-09-05
- Last modified
- 2026-09-07
Affected products
- scriptsbundle Nokri – Job Board WordPress Theme
Weakness type
Related vulnerabilities
- CVE-2026-8821 — Playbooks run owner channel membership permission bypass
- CVE-2026-20324 — Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution Vulnerability
- CVE-2026-57139 — PraisonAI MCPServer exposes unauthenticated HTTP tools/call
- CVE-2026-75030 — Apache Syncope: Incomplete authorization checks for Group members deprovisioning
- CVE-2026-57131 — praisonai: Jobs API exposes agent-execution endpoints with no authentication
- CVE-2026-14349 — TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action
- CVE-2026-66887 — Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups
- CVE-2026-38056 — ST Engineering iDirect iQ-Series Terminals Missing Authorization