Nokri Job Board EUVD-2026-69021

Exploitation requires that the target account has an empty or unset sb_password_forget_token user meta value - the default state for any user who has not an active pending reset - allowing an empty attacker-supplied token to satisfy the check in nokri_reset_password(). The attacker must reach the theme's password-reset handler over the network and know or guess the target account (e.g. the administrator username). Limiting factors are minimal: no authentication, no user interaction, and no special configuration are needed beyond having the Nokri theme (version ≤ 1.6.6) installed and active; the main practical constraint is that an account which currently has a legitimately issued, non-empty reset token pending would not match an empty token.

This should be treated as a high-priority issue. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects remote, unauthenticated, low-complexity exploitation with no user interaction and full compromise of confidentiality, integrity, and availability at the application level - consistent with the described logic flaw. Because exploitation requires only submitting an empty token against an account whose reset token is unset (the common default state), the attack is trivially automatable and well-suited to mass scanning of WordPress sites, which typically drives high real-world exploitation probability even where an EPSS score is not provided in this input. No EPSS value, POC, or CISA KEV entry is included, so there is no confirmation of active exploitation yet; the risk here is driven by the low barrier to exploit rather than by observed campaigns. Any operator running this theme, from small single-site deployments to larger hosting fleets, should treat administrator account takeover as an imminent threat and prioritize remediation over waiting for exploitation telemetry.

An attacker enumerates or guesses a valid username (such as the default admin), then submits the theme's password-reset request with an empty reset token and a new password of their choosing. Because the empty token matches the target's unset sb_password_forget_token meta, the reset succeeds and the attacker logs in as that user; given AV:N/AC:L/PR:N/UI:N this can be scripted against many sites at once. No public POC is identified at time of analysis.