Privilege Escalation in Nokri Job Board WordPress Theme by Vendor

CVE-2024-12824

What is CVE-2024-12824?

The Nokri Job Board WordPress Theme contains a vulnerability that allows unauthorized users to escalate privileges through account takeover. This is due to insufficient validation of token values during user detail updates, including password changes. Attackers can exploit this flaw to change any user's password, including that of administrators, granting them unauthorized access to user accounts. Websites utilizing versions up to and including 1.6.2 are particularly at risk and should take immediate action to secure their installations.

References