CVE-2026-18550

Name of the Vulnerable Software and Affected Versions Nokri - Job Board WordPress Theme versions prior to 1.6.7

Description Insufficient reset token validation in the nokri reset password() function allows unauthenticated attackers to perform privilege escalation via account takeover. By providing an empty reset token in the token parameter, an attacker can match empty or unset sb password forget token user meta values, enabling the password reset of any user, including administrators.

Recommendations Update to a version newer than 1.6.6. As a temporary workaround, restrict access to the password reset functionality until the update is applied.