A critical flaw in the Nokri – Job Board WordPress theme lets unauthenticated attackers reset any user's password, including administrators, by submitting an empty reset token.
What Is It
CVE-2026-18550 is a privilege escalation vulnerability via account takeover in the Nokri – Job Board WordPress Theme by scriptsbundle. The root cause is insufficient reset token validation in the nokri_reset_password() function. An empty attacker-supplied reset token will match an empty or unset sb_password_forget_token user meta value, meaning the check passes for any account that has never initiated a password reset.
The issue is classified as CWE-269 (Improper Privilege Management) and carries a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It was published to NVD on 2026-09-01 with a status of "Received," reported by Wordfence.
Why It Matters
There is no authentication barrier, no user interaction, and no complexity to overcome; the attack is remote, network-reachable, and fully automatable. Successful exploitation yields full control of an arbitrary account, up to and including the WordPress administrator. That translates directly to complete site compromise: high confidentiality, integrity, and availability impact, reflected in the 3.9 exploitability subscore (the maximum) and 5.9 impact subscore.
Job board sites built on this theme typically hold applicant PII, resumes, contact details, employment history, making the confidentiality impact concrete rather than theoretical.
What's Vulnerable
- Vendor: scriptsbundle
- Product: Nokri – Job Board WordPress Theme
- Affected versions: all versions up to and including 1.6.6
The NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-18550) assigns no CPE entries. There is no CISA KEV entry for this CVE, so there is no confirmation of active exploitation in the wild from that source.
Patch Status
The NVD entry does not identify a fixed version, patch release, or vendor advisory, and lists no required remediation action or due date. Operators running Nokri 1.6.6 or earlier should check the vendor and ThemeForest listings below for an updated release, and treat any site running an affected version as exposed until a fix is confirmed.
Sources
- NVD, CVE-2026-18550 (published 2026-09-01), https://nvd.nist.gov/vuln/detail/CVE-2026-18550
- Wordfence Threat Intelligence; https://www.wordfence.com/threat-intel/vulnerabilities/id/b03b7ea8-6485-495d-b815-2b7b882a75a2?source=cve
- Nokri (vendor site), https://nokriwp.com/
- ThemeForest product listing; https://themeforest.net/item/nokri-job-board-wordpress-theme/22677241