PT-2025-9156 · WordPress · The Nokri – Job Board Wordpress Theme

Lucio Sá · Published 2025-03-01 · Updated 2025-03-06 · CVE-2024-12824

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Nokri – Job Board WordPress Theme versions up to, and including, 1.6.2

Description The issue allows for privilege escalation via account takeover due to the plugin not properly checking for an empty token value prior to updating user details, such as the password. This enables unauthenticated attackers to change the password of arbitrary users, including administrators, and gain access to their accounts.

Recommendations For versions up to, and including, 1.6.2, update to a version that includes a fix for this issue to prevent privilege escalation via account takeover.

Fix

LPE

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2024-12824

Affected Products

The Nokri – Job Board Wordpress Theme

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-12824 · Security Note
• https://twitter.com/CveFindCom/status/1895731097381511410 · Twitter Post
• https://t.me/cvedetector/19227 · Telegram Post
• https://twitter.com/CVEnew/status/1895981999556591814 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/60a7cce0-637f-49bd-aa4a-fd7023d99a64?source=cve · Note
• https://twitter.com/cracbot/status/1897603140788306334 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1895749068367810686 · Twitter Post
• https://t.me/cvenotify/112969 · Telegram Post
• https://twitter.com/cybercronai/status/1896115882717307243 · Twitter Post
• https://twitter.com/vulns_space/status/1895742456659853464 · Twitter Post
• https://themeforest.net/item/nokri-job-board-wordpress-theme/22677241 · Note