What is the CVSS score of CVE-2024-12824?

CVE-2024-12824 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 58.7%.

Which versions of WordPress are affected by CVE-2024-12824?

Organizations using all face critical risk from CVE-2024-12824 rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems.

Is there a public PoC exploit available for CVE-2024-12824?

Yes, a public proof-of-concept exploit is available for CVE-2024-12824. Prioritise patching immediately. EPSS: 58.7%.

How to fix or mitigate CVE-2024-12824?

Within 24 hours: Identify all affected systems running all and apply vendor patches immediately. Monitor vendor channels for patch availability.

WordPress CVE-2024-12824

CRITICAL

Unverified Password Change (CWE-620)

2025-03-01 security@wordfence.com

WordPress Privilege Escalation

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 01, 2025 - 07:15 nvd

CRITICAL 9.8

DescriptionCVE.org

The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's password, including administrators, and leverage that to gain access to their account.

AnalysisAI

The Nokri Job Board WordPress theme through version 1.6.2 contains a privilege escalation via account takeover. The password reset handler fails to check for empty token values, allowing unauthenticated attackers to reset any user's password including administrators by submitting an empty verification token.

Technical ContextAI

The email confirmation/password reset handler compares the submitted token against the stored token without checking for empty or null values. When both tokens are empty (the user hasn't requested a reset), the comparison succeeds. An attacker can reset any user's password by submitting an empty token for a target user ID.

Affected ProductsAI

Nokri Job Board WordPress Theme <= 1.6.2

RemediationAI

Update the Nokri theme immediately. Implement proper token validation that rejects empty/null values. Force password resets for all users. Review the user database for unauthorized changes.