CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's password, including administrators, and leverage that to gain access to their account.
Explanation of Vulnerability in Simple Terms
Nokri Job Board WordPress Theme versions up to 1.6.2 contain a critical vulnerability that allows unauthenticated attackers to read sensitive data, modify site content, and disrupt service. The vulnerability requires no user interaction and can be exploited remotely over the network. Site administrators should update immediately to a version newer than 1.6.2.
What an attacker can do
Read sensitive data, modify or delete content, and disrupt site availability without authentication.
Potential impact on your site
Your site's data, content, and availability are at immediate risk from remote attackers.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
