EUVD-2026-57902
GHSA-qmjg-fffq-xh82
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Nokri ≤1.6.6
-
DeliverySend crafted request to recovery/protected endpoint
-
ExploitBypass missing authorization check
-
ExecutionRecover or take over target account
-
ImpactAccess restricted data or functions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Password recovery security
|
| Exploitation Conditions | The target must be a WordPress site running the Nokri theme at version 1.6.6 or earlier with the vulnerable account-recovery/access-controlled functionality reachable over the network. Per the CVSS vector (PR:N/UI:N/AC:L), exploitation is unauthenticated, requires no user interaction, and is low complexity against a default deployment; the main limiting factor is simply that the specific Nokri theme must be installed and its affected endpoint exposed. CWE-640 indicates the weakness lies in the password/account recovery workflow, so the relevant feature is the theme's forgotten-password or account-recovery mechanism rather than a non-default configuration option. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) presents a worst-case profile: network-reachable, low complexity, no privileges, no user interaction, with high impact across all three security properties. However, no EPSS score, SSVC decision, POC, or KEV signal is present in the input, so the only strong evidence of real-world risk is the CVSS and the Patchstack tagging. There is a notable tension worth flagging: the description and Patchstack tag emphasize 'Information Disclosure' / broken access control and CWE-640 (password recovery), which typically map to a confidentiality-centric or account-takeover impact rather than the full C:H/I:H/A:H claimed - verify the true integrity/availability impact with the vendor advisory, as the 9.8 may be an upper-bound rating. Net: treat as a high-priority patch for exposed Nokri installations, but the absence of EPSS/KEV/POC data means active exploitation is not confirmed. |
| Exploit ScenarioDerived | A remote unauthenticated attacker sends a crafted request directly to the Nokri theme's account-recovery or protected endpoint, exploiting the missing authorization check to recover or take over another user's account or read data that should require authentication. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network reachability to the WordPress site and no credentials or victim interaction. No public exploit code is identified at time of analysis, so exploitation would currently require an attacker to independently reconstruct the flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 13, 2026
Broken access control in the Nokri WordPress job board theme (versions 1.6.6 and earlier by ScriptsBundle) lets remote unauthenticated attackers bypass authorization controls to access or manipulate resources that should be restricted, with the CWE-640 mapping indicating a weakness in the account/password recovery mechanism. Rated CVSS 9.8 with a full network/no-privilege/no-interaction vector implying full confidentiality, integrity, and availability impact, this issue is reported by Patchstack and tagged as information disclosure. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified at time of analysis in the provided data, so the primary action is to consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/nokri/vulnerability/wordpress-nokri-theme-1-6-6-broken-access-control-vulnerability) and upgrade to any release newer than 1.6.6 as soon as ScriptsBundle publishes one, verifying the fixed version directly with the vendor. Until a patched build is confirmed, compensating controls include placing the affected account-recovery and profile endpoints behind a WAF or virtual patch (Patchstack offers a managed rule for this vulnerability), restricting or rate-limiting access to the theme's password-recovery and AJAX endpoints, and monitoring for anomalous password-reset or account-access requests - noting that WAF rules may need tuning to avoid blocking legitimate candidate/employer registration and recovery flows. Disabling or temporarily removing the Nokri theme is the strongest mitigation but breaks the job-board site functionality, so it is a last resort.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Nokri is a commercial WordPress theme sold via ScriptsBundle (CPE cpe:2.3:a:scriptsbundle:nokri) that provides job-board functionality including user registration, candidate/employer profiles, and account management on top of WordPress. The vulnerability class is CWE-640 (Weak Password Recovery Mechanism for Forgotten Password), a specific form of broken access control where the password/account recovery workflow fails to properly validate the requesting identity, allowing an attacker to reset, recover, or take over an account or reach protected endpoints without proper authorization. Because the theme extends WordPress's authentication and profile handling with its own AJAX/endpoint logic, an insecure recovery or access-control check in that custom code exposes protected functionality to unauthenticated callers.
Know when Nokri gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network access to a broken recovery mechanism (PR:N/UI:N/AC:L) enables account takeover, so C:H/I:H; availability impact is limited (A:L) as the flaw is disclosure/access-control rather than service-destroying.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.
Executive ViewAI
The Nokri WordPress job board theme (versions 1.6.6 and earlier) contains a critical broken access control vulnerability enabling unauthenticated attackers to bypass authorization controls and access or manipulate restricted resources. Organizations using this theme for recruitment workflows face immediate risk of unauthorized access to candidate data, job listings, and other sensitive information.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the Nokri plugin entirely, implement WAF rules restricting access to job board functionality, enforce multi-factor authentication at the WordPress admin level, enable detailed access logging for the affected theme, and segment job board data from other business systems where possible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB