CVE-2025-9049

HighCVSS 8.8/10Last modified Oct 19, 2026

Description

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Sep 5, 2026
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-90509.8A vulnerability was found in projectworlds Travel Management System 1.0. Affected by this vulnerability is an unknown functionality of the fCVE-2025-90519.8A vulnerability was determined in projectworlds Travel Management System 1.0. Affected by this issue is some unknown functionality of the fiCVE-2025-90529.8A vulnerability was identified in projectworlds Travel Management System 1.0. This affects an unknown part of the file /updatepackage.php. TCVE-2025-90539.8A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /updatesubCVE-2025-90549.8The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data thaCVE-2025-90556.4The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privilegesCVE-2025-90565.3Unprotected service in the AudioLink component allows a local attacker to overwrite system files via unauthorized service invocation.CVE-2025-90576.4The Biagiotti Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.3 CVE-2025-90586.4The Mikado Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.5.2 dueCVE-2025-90598.8The Altiris Core Agent Updater package (AeXNSC.exe) is prone to an elevation of privileges vulnerability through DLL hijacking.CVE-2025-90609.1A vulnerability has been found in the  MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs iCVE-2025-90616.4The Wilmer Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.4.5 due