Nokri Job Board WordPress Theme Privilege Escalation Vulnerability
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- nokri - job board (wordpress)
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the Nokri Job Board WordPress Theme. Versions up to and including 1.6.6 are reportedly affected.
What happened
The Nokri Job Board WordPress Theme is under investigation for a critical vulnerability that allows for Privilege Escalation via Account Takeover. This vulnerability, tracked as CVE-2026-18550, is due to insufficient reset token validation. Unauthenticated attackers may be able to reset the password of any user, including administrators, and gain access to their accounts. This issue affects all versions up to and including 1.6.6.
To assess your exposure, check if your WordPress site is using the Nokri Job Board Theme version 1.6.6 or earlier. If so, it is recommended to upgrade to a version beyond 1.6.6 as soon as possible. Additionally, review user accounts for any suspicious activity that may indicate a compromise.
What to do about it
- Upgrade the Nokri Job Board WordPress Theme to a version beyond 1.6.6.
- Review all user accounts for any suspicious activity.
- Monitor the primary sources for updates on the vulnerability and any official fixes that may be released.
- Consider implementing additional security measures to protect against potential account takeovers.
How 0Day would have caught this
nokri - job board is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using the Nokri Job Board WordPress Theme version 1.6.6 or earlier.
What should I do right now?
Upgrade to a version beyond 1.6.6 and review user accounts for any suspicious activity.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.