Nokri Job Board Theme CVE-2025-9049

Exploitation requires an authenticated WordPress subscriber account on the target site - on job board deployments, subscriber self-registration is typically enabled by default (job seekers register to apply for positions), making account creation open to any internet user. The vulnerable function nokri_account_member_permissions must be present, meaning the Nokri theme must be active and unpatched (version 1.6.4 or earlier). No special configuration beyond theme activation is required. The primary factor limiting exploitation is the need for a valid subscriber account, which is trivially satisfied on any site permitting open registration. Exploitation is not limited to any specific WordPress version or server platform.

The CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the severity: network-exploitable, low complexity, requiring only an existing WordPress account at subscriber tier. The full C:H/I:H/A:H impact is justified because successful exploitation leads to full administrator account takeover, which is effectively complete WordPress instance compromise. No EPSS data or KEV listing is available in the provided intelligence, so real-world exploitation probability cannot be quantified from these signals. The key risk limiter is PR:L - an attacker must already hold a valid WordPress subscriber account, which requires either self-registration (if open) or prior credential compromise. For sites with open subscriber registration (common on job boards, which actively solicit job-seeker accounts), this barrier is effectively zero. The two-stage nature of the attack does not meaningfully increase complexity since both steps are fully scriptable.

An attacker self-registers a free job-seeker account on a Nokri-powered job board site, gaining Subscriber-level WordPress access. The attacker then issues an authenticated AJAX request to nokri_account_member_permissions, exploiting the missing capability check to grant employer permissions to their or a newly created account. The elevated account subsequently uses the employer-facing user-management feature to overwrite the email address of the Administrator account, triggering a WordPress password reset to the attacker-controlled email and completing the takeover. No public exploit code has been identified, but the vulnerability is straightforward to exploit from description alone.