What is the CVSS score of CVE-2025-9049?

CVE-2025-9049 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Nokri Job Board Theme are affected by CVE-2025-9049?

Nokri Job Board WordPress Theme (versions ≤1.6.4) contains a privilege escalation vulnerability enabling any Subscriber-level user to escalate to Administrator and compromise the entire WordPress…

How to fix or mitigate CVE-2025-9049?

Within 24 hours, identify all WordPress installations using Nokri Job Board Theme through 1.6.4 and audit Subscriber accounts for unauthorized privilege escalation; disable the theme if not critical to operations. Within 7 days, review WordPress audit logs for suspicious user role and email changes, verify all administrative accounts remain under authorized control, and implement role-based access restrictions limiting Subscriber permissions. Within 30 days, migrate to an alternative WordPress job board theme with active security support, as no vendor patch has been released; contact Nokri to inquire about security updates and patched versions.

Nokri Job Board Theme CVE-2025-9049

EUVD-2025-210856 HIGH

Missing Authorization (CWE-862)

2026-09-05 Wordfence

GHSA-jmp7-cgxg-w65w

WordPress Nokri Job Board Wordpress Theme Scriptsbundle

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable AJAX endpoint, no complexity, subscriber auth required (PR:L), full admin takeover achieved via two-step privilege escalation justifies C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 05, 2026 - 12:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Sep 05, 2026 - 12:22 vuln.today

CVE Published

Sep 05, 2026 - 11:28 nvd

HIGH 8.8

DescriptionCVE.org

The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.

AnalysisAI

Privilege escalation in the Nokri Job Board WordPress Theme (all versions through 1.6.4) allows authenticated attackers with Subscriber-level access to perform a two-stage account takeover: they invoke the unprotected nokri_account_member_permissions function to grant employer-level permissions to any Subscriber account, and the elevated Subscriber can then update the email address of any WordPress user - including Administrators - enabling full site compromise via password reset. Reported by Wordfence, this vulnerability scores CVSS 8.8 (AV:N/AC:L/PR:L). No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The Nokri theme (CPE: cpe:2.3:a:scriptsbundle:nokri_-_job_board_wordpress_theme:*:*:*:*:*:*:*:*) is a commercial WordPress job board theme distributed via ThemeForest. The root cause is CWE-862 (Missing Authorization): the AJAX handler nokri_account_member_permissions does not verify whether the caller holds the necessary WordPress capability before modifying account permission state. WordPress capability checks (current_user_can()) are the standard guard for privileged AJAX endpoints; their absence means any authenticated user, regardless of role, can invoke the function. The theme's employer permission model is the pivot point - once granted, employer-level privileges allow email-address updates on arbitrary user accounts, which breaks WordPress's authentication chain because a controlled email address enables trivially triggering a password reset for that account.

RemediationAI

Update the Nokri theme to the version that resolves this issue; the Wordfence advisory and ThemeForest changelog (linked in references) should be consulted to confirm the exact patched release version, as no explicit fix version number appears in the available intelligence data. As a compensating control pending upgrade, disable open subscriber self-registration if it is enabled (Settings → General → uncheck 'Anyone can register') to eliminate the unauthenticated entry point for creating attacker-controlled subscriber accounts. Additionally, audit existing subscriber and employer accounts for unauthorized entries. Site administrators should also review whether any existing user email addresses have been modified unexpectedly. Restricting public job-seeker registration entirely is an effective but disruptive workaround that trades functionality for security posture until patching is possible.