CVE-2025-9049 in Nokri Job Board Plugin
Summary
by MITRE • 09/05/2026
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified within Nokri – Job Board WordPress Theme versions up to 1.6.4 represents a critical failure in access control mechanisms, specifically categorized under CWE-285: Improper Authorization. The core technical flaw resides in the nokri_account_member_permissions function, which lacks an adequate capability check before processing requests that modify user permissions. In a secure implementation of WordPress architecture, any operation that alters administrative settings or modifies user roles must verify that the initiating request originates from a user with sufficient privileges, typically Administrator level. By omitting this verification step, the theme inadvertently exposes sensitive functionality to lower-privileged users, creating an unauthorized data modification pathway.
The operational impact of this flaw is significant due to its potential for privilege escalation. An attacker possessing Subscriber-level access or higher can exploit this missing check to add new user accounts with employer account member permissions. This initial foothold allows the attacker to manipulate role assignments within the system. More critically, the vulnerability extends beyond simple permission assignment; it enables the modification of email addresses associated with any existing user profile in the database. By changing the email address linked to an Administrator account, an attacker can trigger a password reset mechanism or intercept administrative communications, effectively taking control of high-privilege accounts without needing their current credentials.
This attack vector aligns closely with MITRE ATT&CK techniques related to Account Manipulation and Privilege Escalation. Specifically, it reflects behaviors associated with creating backdoor accounts and modifying user attributes to maintain persistence or escalate privileges within the environment. The ability to alter administrator email addresses bypasses standard authentication controls, allowing the attacker to assume full control over the WordPress installation. This compromises not only the integrity of the application but also potentially leads to broader system compromise if the WordPress instance is integrated with other services or contains sensitive data accessible through administrative functions.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary solution is for administrators to update the Nokri theme to a version where this capability check has been properly implemented by the developers. Until an official patch is available, site owners should consider restricting access to user management features or implementing additional server-side validation rules that enforce role-based access control strictly according to WordPress standards. Furthermore, enabling multi-factor authentication for all administrative accounts can mitigate the risk of account takeover resulting from email address manipulation. Regular security audits and code reviews focusing on capability checks in custom functions are essential to prevent similar authorization flaws in future updates or custom integrations.