VULNERABILITY INTELLIGENCE

CVE-2025-9049

CVSS score8.8 HIGH
EPSS probability0.44%
CISA KEVNot currently listed
Published2026-09-05
Last modified2026-10-19
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.

Weakness classification

  • security@wordfence.com: CWE-862

Primary references