Overview
The Nokri – Job Board WordPress Theme for WordPress is exposed to a serious security vulnerability that could allow threat actors to escalate their privileges via account takeover. This vulnerability, designated as CVE-2025-1313, affects all versions of the theme up to and including 1.6.3. It’s a significant concern for any individual or organization that uses the Nokri – Job Board WordPress Theme, as it opens up the potential for system compromise or data leakage.
Vulnerability Summary
CVE ID: CVE-2025-1313
Severity: High (CVSS: 8.8)
Attack Vector: Network
Privileges Required: Low (Subscriber-level access and above)
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Nokri – Job Board WordPress Theme | Up to and including 1.6.3
How the Exploit Works
The vulnerability stems from the plugin’s failure to properly validate a user’s identity prior to updating their details, such as the email address. An attacker with subscriber-level access could exploit this vulnerability by changing the email addresses of arbitrary users, including administrators. Subsequently, the attacker can leverage this change to reset the user’s password, thus gaining access to their account.
Conceptual Example Code
Here is a hypothetical example of how this vulnerability could be exploited, using a HTTP request:
POST /wp-admin/user-edit.php?user_id=1 HTTP/1.1
Host: vulnerable-website.com
Content-Type: application/x-www-form-urlencoded
user_email=attacker@example.com&_wpnonce=xxxxxx&updateuser=Update+UserIn this example, the attacker is sending a POST request to the user-edit page of an administrator account (user_id=1). The attacker changes the administrator’s email to their own (attacker@example.com) and submits the form.
Mitigation Guidance
Users are recommended to apply the vendor patch to mitigate this vulnerability. In the absence of such a patch, a web application firewall (WAF) or intrusion detection system (IDS) can provide temporary mitigation. However, these options should not be considered a long-term solution, as they do not address the underlying vulnerability.