blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-18550

CRITICAL 9.8 CVSS 3.1
Published
September 1, 2026
Last modified
September 2, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-269
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the `nokri_reset_password()` function, which allows empty attacker-supplied reset tokens to match empty or unset `sb_password_forget_token` user meta values. This makes it possible for unauthenticated attackers to reset the password of any user, including administrators, and gain access to their account.

Affected products and versions

  • scriptsbundle Nokri – Job Board WordPress Theme — Up to and including 1.6.6

References

  • nokriwp.com https://nokriwp.com/
  • themeforest.net https://themeforest.net/item/nokri-job-board-wordpress-theme/22677241
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/b03b7ea8-6485-495d-b815-2b7b882a75a2?source=cve
  • nvd.nist.gov Official NVD record