CVE-2026-18550: falha crítica em scriptsbundle Nokri – Job Board WordPress Theme
Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.6%
The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the `nokri_reset_password()` function, which allows empty attacker-supplied reset tokens to match empty or unset `sb_password_forget_token` user meta values. This makes it possible for unauthenticated attackers to reset the password of any user, including administrators, and gain access to their account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
scriptsbundle · Nokri – Job Board WordPress ThemeCVEs relacionadas — scriptsbundle Nokri – Job Board WordPress Theme
No mesmo produto, das mais perigosas para as menos.
CVE-2024-12824CRITICALNokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password ChangeEPSS 2.4%CVE-2025-9049HIGHNokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account TakeoverEPSS 0.4%CVE-2025-1313HIGHNokri - Job Board WordPress Theme <= 1.6.3 - Authenticated (Subscriber+) Privilege Escalation via Account TakeoverEPSS 0.4%