What is the CVSS score of EUVD-2025-21206?

EUVD-2025-21206 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2025-21206?

This vulnerability allows any authenticated WordPress user with basic subscriber privileges to hijack administrator accounts by changing email addresses and resetting passwords, potentially granting…

How to fix or mitigate EUVD-2025-21206?

Within 24 hours: Audit all user account email changes in WordPress logs and verify administrator account integrity; disable user self-service password reset functionality if possible. Within 7 days: Contact Nokri theme developers for patch availability status and consider switching to an alternative job board solution if no patch timeline is provided. Within 30 days: Implement a patched version immediately upon release, or migrate to a maintained alternative theme with security-first development practices.

PHP EUVD-2025-21206

| CVE-2025-1313 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2025-07-12 security@wordfence.com

WordPress Privilege Escalation PHP Authentication Bypass

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2025-21206

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

CVE Published

Jul 12, 2025 - 06:15 nvd

HIGH 8.8

DescriptionCVE.org

The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email address. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.

AnalysisAI

The Nokri - Job Board WordPress Theme contains a critical privilege escalation vulnerability (CVE-2025-1313) affecting all versions up to 1.6.3, where authenticated Subscriber-level users can change arbitrary user email addresses without proper identity validation. This allows attackers to reset administrator passwords and achieve complete account takeover, resulting in full WordPress site compromise. With a CVSS score of 8.8 and low attack complexity requiring only valid subscriber credentials, this vulnerability poses significant real-world risk to WordPress installations using this theme.

Technical ContextAI

The Nokri Job Board WordPress Theme (CPE: wp:nokri_job_board) contains an Improper Input Validation / Missing Authorization weakness (CWE-288: Authentication Bypass Using an Alternate Path or Channel) in its user profile update functionality. The theme fails to implement proper identity verification before processing user detail changes, specifically email address modifications. This is a classic broken access control vulnerability where the application accepts authenticated requests but does not verify the requester has authorization to modify the target user's account. The vulnerability exists in the theme's user management endpoints, likely in AJAX handlers or REST API endpoints that handle user profile updates, allowing any authenticated user with Subscriber role or higher to invoke privileged account modification operations without additional authorization checks.