CVE-2025-9049

Name of the Vulnerable Software and Affected Versions Nokri – Job Board WordPress Theme versions prior to 1.6.5

Description An issue exists due to a missing capability check in the nokri account member permissions() function. This allows authenticated users with Subscriber-level access or higher to assign employer account member permissions to new Subscriber users. Subsequently, these users can escalate privileges by modifying the email address of any user, including those with Administrator roles.

Recommendations Update Nokri – Job Board WordPress Theme to version 1.6.5 or later. As a temporary mitigation, restrict access to the nokri account member permissions() function.