The Nokri – Job Board WordPress Theme is vulnerable to privilege escalation, allowing authenticated attackers to gain administrative control over the WordPress installation.

The theme fails to perform necessary capability checks on the nokri_account_member_permissions function, allowing any authenticated user with Subscriber-level access to manipulate user permissions. This flaw enables attackers to escalate privileges by modifying the email addresses of existing accounts, including those with Administrator status.

This vulnerability poses a severe risk to organizational security, as it allows unauthorized users to achieve full administrative control over the WordPress environment. Given the CVSS score of 8.8, the impact includes total compromise of site integrity, potential data exfiltration, and the risk of complete system takeover. Such unauthorized access can lead to significant reputational damage and the loss of sensitive user or business data.

Immediate Action: Update the Nokri – Job Board WordPress Theme to version 1.6.6 or later immediately to resolve the missing authorization flaw.

Proactive Monitoring: Review user account modification logs for suspicious activity, specifically looking for unexpected changes to user roles or email addresses associated with administrative accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious requests directed at the theme's core functions, although this should be treated as a temporary measure until the theme is updated.

Public Exploit Available: Unknown

The vulnerability represents a critical security oversight in the theme's authorization logic, providing a clear path for privilege escalation. Administrators must prioritize updating to version 1.6.6 as soon as possible to prevent potential account takeovers. If an update cannot be performed immediately, restrict access to the site or disable the theme to neutralize the attack vector.