The Nokri – Job Board WordPress Theme contains an authentication bypass vulnerability (CWE-288) due to improper validation of user identity before updating account details such as email addresses. Authenticated users with low privileges can exploit this to change email addresses of other users, including administrators, facilitating password resets and account takeovers. The vulnerability affects all versions up to and including 1.6.3 and has a CVSS 3.1 score of 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows attackers with Subscriber-level access to escalate privileges by hijacking accounts of other users, including administrators. This compromises confidentiality, integrity, and availability of the affected WordPress site by enabling unauthorized access and control over user accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access and monitor for suspicious account changes. Avoid using vulnerable versions of the Nokri theme and consider disabling or replacing it if possible.