CVE-2026-18550: Nokri WordPress Theme Unauthenticated Account Takeover

Summary

CVE-2026-18550 is a critical privilege escalation via account takeover vulnerability (CWE-269: Improper Privilege Management) affecting the Nokri – Job Board WordPress Theme by scriptsbundle, in use on job-listing and recruitment sites built on WordPress. The flaw affects all versions up to and including 1.6.6 and carries a CVSS score of 9.8 (Critical). No authentication or user interaction is required to exploit it.

The bug lives in the theme's nokri_reset_password() function, which handles password-reset requests. Insufficient validation of the reset token allows an empty attacker-supplied token to match an empty or unset sb_password_forget_token user-meta value — effectively bypassing the token check entirely for any account that has never requested a password reset (which, on most sites, is every account, including the administrator's).

Vulnerability Details

Affected Versions

This is the second time this password-reset code path has been flagged: an earlier flaw in the same theme, CVE-2024-12824, allowed arbitrary password changes for the same underlying reason — the theme not properly rejecting an empty token value. CVE-2026-18550 shows that class of bug persisting into nokri_reset_password() in later releases, up to and including 1.6.6.

Root Cause and Attack Scenario

1. Attacker identifies a WordPress site running the Nokri theme
2. Attacker selects a target account (e.g. "admin" or a known username)
3. Attacker submits a password-reset request with an EMPTY reset token
4. nokri_reset_password() compares the empty token against the user's
   sb_password_forget_token meta value — which is also empty/unset for
   any account that has never triggered a legitimate reset
5. The comparison succeeds; the attacker sets a new password for the
   targeted account without ever proving ownership of it
6. Attacker logs in as the compromised user, including administrators

Because the vulnerable comparison only fails once a real reset token has been generated and stored, every account that has never used the "forgot password" flow is exploitable by default — which on most installs includes the site administrator.

Impact of Successful Exploitation

Remediation

No fixed release has been published for this specific advisory at the time of writing. Until an update ships, apply the following mitigations:

1. Restrict or disable the password-reset endpoint at the web server or WAF layer if it is not actively needed
2. Force a password reset with a real token for every existing account (admin included) so the sb_password_forget_token meta is no longer empty — this closes the specific bypass condition described above
3. Deploy a WAF rule blocking password-reset requests that submit an empty or missing token parameter
4. Enable multi-factor authentication for all administrator and editor accounts as defense in depth
5. Monitor for unexpected password-reset activity and new/modified admin accounts
6. Watch the vendor's changelog (nokriwp.com) and Wordfence's advisory for a patched release, and update immediately once available

Detection Indicators

References

• Wordfence Threat Intelligence — CVE-2026-18550
• NIST NVD — CVE-2026-18550
• GitHub Advisory Database — CVE-2024-12824 (related prior flaw)

Related Reading

• Critical Auth Bypass in Tutor LMS Pro Exposes 30,000+
• CVE-2026-9701: WordPress Eventer Insecure Password Reset
• Critical RCE in WPvivid Backup Plugin Threatens 900,000+