CVE-2026-18550: CWE-269 Improper Privilege Management in scriptsbundle Nokri – Job Board WordPress Theme

CVE-2026-18550 is a privilege escalation vulnerability in the Nokri – Job Board WordPress Theme caused by improper privilege management (CWE-269). The vulnerability exists in the nokri_reset_password() function, where empty attacker-supplied reset tokens can match empty or unset sb_password_forget_token user meta values. This flaw allows unauthenticated attackers to reset passwords of any user, including administrators, leading to account takeover and potential full system compromise. The vulnerability affects all versions up to and including 1.6.6. There is no official patch or remediation level currently provided by the vendor or authoritative sources.

An unauthenticated attacker can reset the password of any user, including administrators, resulting in complete account takeover. This leads to full compromise of user accounts and potentially the entire WordPress site using the Nokri theme. The CVSS score of 9.8 reflects the critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to password reset functionality if possible and monitor for suspicious password reset activity. Avoid using affected versions in production environments where possible.