CVE-2025-9049

{
  "id": "CVE-2025-9049",
  "sourceIdentifier": "[email protected]",
  "published": "2026-09-05T12:16:46.653",
  "lastModified": "2026-10-19T22:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users."
    },
    {
      "lang": "es",
      "value": "El tema Nokri - Job Board para WordPress es vulnerable a la modificación no autorizada de datos debido a la falta de verificación de capacidad en la función ’nokri_account_member_permissions’ en todas las versiones hasta la versión 1.6.4 incluida. Esto permite que atacantes autenticados con acceso de nivel Suscriptor o superior agreguen nuevos usuarios Suscriptor con permisos de miembro de cuenta de empleador, quienes a su vez pueden escalar privilegios actualizando la dirección de correo electrónico de cualquier usuario, incluidos los usuarios Administrador."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "scriptsbundle",
          "product": "Nokri – Job Board WordPress Theme",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.6.4",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-09-07T11:03:38.573775Z",
          "id": "CVE-2025-9049",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://themeforest.net/item/nokri-job-board-wordpress-theme/22677241#item-description__nokri-theme-change-logs",
      "source": "[email protected]"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e079e886-70a5-4188-ad99-96fc37651ed0?source=cve",
      "source": "[email protected]"
    }
  ]
}