CVE-2025-1313: Nokri Job Board Privilege Escalation Flaw

CVE-2025-1313 Overview

CVE-2025-1313 is a privilege escalation vulnerability in the Nokri - Job Board WordPress Theme affecting all versions up to and including 1.6.3. The theme fails to validate a user's identity before updating account details such as the email address. Authenticated attackers with Subscriber-level access or higher can modify the email address of any user, including administrators. After changing the email, the attacker triggers a password reset, captures the reset link, and takes over the targeted account. The flaw is categorized under [CWE-288: Authentication Bypass Using an Alternate Path or Channel].

Critical Impact
Any low-privileged authenticated user can take over administrator accounts and gain full control of the WordPress site.

Affected Products

Nokri - Job Board WordPress Theme versions 1.0 through 1.6.3
WordPress installations using the vulnerable theme
Sites where user registration is enabled (Subscriber role available)

Discovery Timeline

2025-07-12 - CVE-2025-1313 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-1313

Vulnerability Analysis

The Nokri theme exposes an account update routine that accepts a target user identifier and new profile values such as the email address. The handler does not verify that the authenticated session belongs to the user being modified. As a result, any logged-in user can submit a request that rewrites another user's email field.

Once the attacker controls the email address tied to an administrator account, they invoke the standard WordPress password reset flow. The reset link is delivered to the attacker-controlled mailbox, granting full credential takeover. The attacker then authenticates as the administrator and inherits all site-level privileges.

The network attack vector and low privilege requirement make this issue trivially exploitable on any site that allows public registration.

Root Cause

The root cause is a missing authorization check on the profile update endpoint. The handler trusts client-supplied user identifiers without comparing them to the current session's user ID or verifying a capability such as edit_user. This pattern matches CWE-288, where the code path bypasses the authentication boundary that protects per-user data.

Attack Vector

An attacker registers a Subscriber account on a vulnerable site or uses any existing low-privileged credential. They then issue a crafted request to the theme's profile update endpoint, supplying the administrator's user ID and an attacker-controlled email address. After the update succeeds, the attacker requests a password reset for the administrator account through wp-login.php?action=lostpassword. WordPress sends the reset token to the new email address, allowing the attacker to set a new password and log in as the administrator.

No verified exploit code is publicly available. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-1313

Indicators of Compromise

Unexpected changes to the user_email field in the wp_users table, especially for administrator accounts
Password reset emails sent to unfamiliar domains shortly after a Subscriber login
New administrator logins from IP addresses or user agents not previously associated with the account
WordPress audit log entries showing profile updates initiated by low-privileged users targeting other user IDs

Detection Strategies

Monitor HTTP POST requests to Nokri theme AJAX endpoints that include a user_id parameter different from the requester's session user
Alert on any modification of administrator email addresses outside of approved change windows
Correlate Subscriber-level authentication events with subsequent password reset requests for higher-privileged accounts

Monitoring Recommendations

Enable WordPress activity logging plugins to capture user profile modifications and password reset events
Forward web server access logs and WordPress audit logs to a centralized SIEM for correlation
Review the wp_users and wp_usermeta tables on a recurring basis for unauthorized changes

How to Mitigate CVE-2025-1313

Immediate Actions Required

Deactivate the Nokri theme until a patched version is installed if one becomes available
Audit all administrator and editor accounts for unauthorized email address changes and reset their credentials
Disable open user registration by unchecking Anyone can register in Settings > General until the theme is remediated
Enforce multi-factor authentication on every administrative account to limit reset-based takeover

Patch Information

No fixed version is referenced in the NVD entry at the time of publication. All versions up to and including 1.6.3 remain vulnerable. Monitor the ThemeForest Nokri Theme page and the Wordfence Vulnerability Report for vendor updates and apply the patched release as soon as it is published.

Workarounds

Restrict the vulnerable AJAX endpoint at the web server or WAF layer to block requests from non-administrator sessions
Temporarily disable public Subscriber registration to remove the precondition required for exploitation
Apply WAF rules that block profile update requests where the supplied user_id does not match the authenticated session user
Replace the Nokri theme with an alternative job board solution until a vendor fix is available

bash

# Disable public registration via WP-CLI
wp option update users_can_register 0

# Audit administrator email addresses
wp user list --role=administrator --fields=ID,user_login,user_email