External risk intelligence

Nokri WordPress Theme Account Takeover Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-18550

The vulnerability affects a WordPress theme used for job boards, which are inherently designed to be public-facing web applications. Because these sites must remain accessible to the public for users to create accounts and apply for jobs, the login and password reset functionality is exposed to the internet by design.

Privilege Escalation

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects the Nokri WordPress job board theme, allowing unauthorized individuals to take over any user account, including administrators, by exploiting a flaw in the password reset process. This could lead to a complete compromise of the website and its data.

Flaw lets anyone steal admin accounts.
Unauthorized account takeover is possible.
Confirm if your job board is affected.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the password reset function. This allows them to bypass the normal validation checks for reset tokens. By successfully exploiting this, an attacker can take over any user's account, including administrator accounts, granting them full control over the WordPress site.

No authentication is required to attempt the attack.
The vulnerability is triggered by an empty reset token.
Risk includes full account takeover and site control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to take over any user account, including administrator accounts, on a WordPress site using the Nokri theme. This is possible by exploiting a flaw in the password reset function, which improperly validates reset tokens.

User and administrator accounts at risk.
Unauthenticated users can reset passwords.
Complete account takeover is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this critical vulnerability in the Nokri WordPress theme. The first step is to identify all instances of the theme, determine their reachability and business criticality, and then confirm the accountable owner for each instance before planning remediation.

Confirm asset ownership and reachability.
Verify exposure and business impact.
Plan coordinated remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Nokri - Job Board WordPress Theme?

Nokri is a specialized theme for the WordPress platform designed to build job board websites. It provides the necessary infrastructure for recruiters to post jobs and for job seekers to register, manage profiles, and apply for positions. Because it handles user authentication, registration, and profile management, it acts as the primary interface for visitors interacting with the employment portal.

How does CVE-2026-18550 allow for account takeover?

This vulnerability falls under the weakness class of Improper Privilege Management (CWE-269). It exists because the theme's password reset function fails to properly validate the reset token. If an attacker provides an empty token, the system incorrectly matches it against users who do not have a set password reset token, effectively tricking the theme into allowing a password change for any user account, including those with administrative privileges.

Do I need to be logged in to trigger this vulnerability?

No, you do not need to be authenticated to trigger this flaw. The vulnerability exists within the public-facing password reset logic. It is specifically triggered by sending a crafted request containing an empty reset token. Conversely, if a user has already successfully set and configured a unique, non-empty reset token associated with their account, this specific mechanism for bypass would not apply.

Why is this CVE particularly relevant to my job board?

According to Halo Surface Signal, this vulnerability is highly relevant because Nokri is designed to be a public-facing web application. Since job boards require open access for users to register and manage their accounts, the password reset functionality is inherently exposed to the internet. This configuration means that the vulnerable function is accessible to anyone online, increasing the likelihood of unauthorized interaction.

What is the first step to address this issue?

Start by identifying every WordPress instance currently running the Nokri theme within your environment. Once you have a complete inventory, assess the business criticality of each site and determine who is responsible for managing those specific installations. After ownership is established, coordinate with those teams to evaluate the site's exposure and begin planning the necessary updates or mitigation strategies to secure the authentication process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.