Nokri Job Board WordPress Theme Privilege Escalation Vulnerability Allowing Unauthenticated Password Changes

A vulnerability in the Nokri – Job Board WordPress Theme, affecting all versions through 1.6.2, allows for privilege escalation via account takeover. The issue arises because the theme fails to properly validate token values before allowing users to update their details, such as passwords. This flaw enables unauthenticated attackers to change the passwords of any user, including administrators, thereby gaining unauthorized access to their accounts.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, leading to account takeovers, including those of administrators.

Remediation

Users are advised to update the theme to version 1.6.3 or a newer patched version.