The Nokri – Job Board WordPress Theme (versions up to and including 1.6.3) fails to validate a user's identity before allowing updates to account details, such as an email address. This flaw permits any authenticated user with Subscriber‑level permissions or higher to modify any user’s email address, including administrators. Once the attacker changes an administrator’s email, they can trigger a password reset and subsequently gain full control of that administrator account. The primary impact is complete administrative takeover of the WordPress site, enabling any further malicious activity or data exfiltration.

WordPress sites deploying the Nokri – Job Board WordPress Theme, version 1.6.3 or older. The vulnerability affects all installations regardless of configuration, as the issue stems from the theme’s core validation logic.

With a CVSS score of 8.8 the flaw is classified as high severity. The EPSS score of <1% indicates a low probability of exploitation in the wild, yet the risk remains significant because the attacker only needs authenticated access. The vulnerability is not listed in CISA’s KEV catalog, but its potential for administrator compromise makes it a critical concern for site owners. The likely attack path requires an authenticated subscriber to use the theme’s email update functionality, implying an insider or compromised user scenario.