Unauthorized Data Modification in Nokri Job Board WordPress Theme

CVE-2025-9049

What is CVE-2025-9049?

The Nokri – Job Board WordPress Theme is susceptible to unauthorized data modification caused by a missing capability check in the 'nokri_account_member_permissions' function. This weakness enables authenticated attackers with Subscriber-level access and higher to create new Subscriber users with employer account member permissions. These new users can then escalate their privileges by modifying the email addresses of existing users, including those with Administrator rights, compromising the website's integrity and security.

References