EUVD-2026-57902
GHSA-qmjg-fffq-xh82
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network access to a broken recovery mechanism (PR:N/UI:N/AC:L) enables account takeover, so C:H/I:H; availability impact is limited (A:L) as the flaw is disclosure/access-control rather than service-destroying.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.
AnalysisAI
Broken access control in the Nokri WordPress job board theme (versions 1.6.6 and earlier by ScriptsBundle) lets remote unauthenticated attackers bypass authorization controls to access or manipulate resources that should be restricted, with the CWE-640 mapping indicating a weakness in the account/password recovery mechanism. Rated CVSS 9.8 with a full network/no-privilege/no-interaction vector implying full confidentiality, integrity, and availability impact, this issue is reported by Patchstack and tagged as information disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be a WordPress site running the Nokri theme at version 1.6.6 or earlier with the vulnerable account-recovery/access-controlled functionality reachable over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) presents a worst-case profile: network-reachable, low complexity, no privileges, no user interaction, with high impact across all three security properties. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified at time of analysis in the provided data, so the primary action is to consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/nokri/vulnerability/wordpress-nokri-theme-1-6-6-broken-access-control-vulnerability) and upgrade to any release newer than 1.6.6 as soon as ScriptsBundle publishes one, verifying the fixed version directly with the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running Nokri theme version 1.6.6 or earlier and inventory what sensitive data is exposed through the job board interface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today