CVE-2024-12824

Name of the Vulnerable Software and Affected Versions The Nokri – Job Board WordPress Theme versions up to, and including, 1.6.2

Description The issue allows for privilege escalation via account takeover due to the plugin not properly checking for an empty token value prior to updating user details, such as the password. This enables unauthenticated attackers to change the password of arbitrary users, including administrators, and gain access to their accounts.

Recommendations For versions up to, and including, 1.6.2, update to a version that includes a fix for this issue to prevent privilege escalation via account takeover.