Nokri Job Board WordPress Theme Authentication Bypass and Privilege Escalation

Technical Analysis

CVE-2026-18550 (CVSS 9.8) resides in the `nokri_reset_password()` function of the Nokri WordPress theme, which fails to properly validate the `sb_password_forget_token` user meta value during password reset requests. When an attacker submits an empty reset token, it can incorrectly match against empty or unset token values stored for user accounts, bypassing the intended authentication check entirely. This allows unauthenticated remote attackers to reset arbitrary user passwords, including those of site administrators, leading to full site compromise. Exploitation requires no prior authentication or user interaction, making this trivially weaponizable via automated scanning and exploitation tools. If a compromised WordPress instance hosts or interfaces with AI agent orchestration tools (e.g., plugins that expose REST APIs to LLM-based agents, or admin panels storing API keys for RAG/agent integrations), attackers gaining admin access could exfiltrate embedded credentials, tamper with agent-facing content, or pivot into connected automation pipelines.

Affected Systems

Nokri - Job Board WordPress Theme, all versions up to and including 1.6.6; WordPress installations with this theme active

Indicators of Compromise

• No specific IOCs published at this time; monitor for anomalous requests to wp-login.php or theme-specific password reset endpoints with empty token parameters

Remediation Steps

1. 1

   Update Nokri Theme

   Upgrade the Nokri Job Board theme to a patched version beyond 1.6.6 as soon as it is released by the vendor.

2. 2

   Audit User Accounts

   Review all administrator and privileged user accounts for unauthorized password changes or suspicious login activity.

3. 3

   Force Password Resets

   Force a password reset for all users and invalidate existing sessions and reset tokens site-wide.

4. 4

   Implement WAF Rules

   Deploy web application firewall rules to detect and block password reset requests with empty or malformed token parameters.

5. 5

   Rotate Exposed Credentials

   If the site integrates with AI agent frameworks, RAG pipelines, or stores API keys accessible via admin panels, rotate all associated credentials and API keys as a precaution.

6. 6

   Enable MFA

   Implement multi-factor authentication for all administrative accounts to reduce impact of future credential-based attacks.