CVE-2025-9049: CWE-862 Missing Authorization in scriptsbundle Nokri – Job Board WordPress Theme

CVE-2025-9049 is a missing authorization vulnerability (CWE-862) in the Nokri – Job Board WordPress Theme affecting all versions up to and including 1.6.4. The issue arises from the lack of a capability check in the 'nokri_account_member_permissions' function, enabling authenticated users with Subscriber-level access or above to add new Subscriber users with elevated employer account permissions. These accounts can escalate privileges by modifying the email addresses of any users, including administrators, potentially leading to full account takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

An attacker with at least Subscriber-level access can create new users with elevated employer permissions and then escalate privileges by updating email addresses of any users, including administrators. This can lead to unauthorized account takeover and full control over the WordPress site, severely impacting confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious account creation or email changes. Avoid granting unnecessary permissions to low-privilege users.