CVE-2026-18550 describes an unauthenticated administrator takeover through an empty reset token — the same root cause Wordfence published as CVE-2024-12824 in March 2025, in the same theme.
What happened
On Tuesday, September 1, 2026 at 12:17 p.m. UTC, NVD published CVE-2026-18550, assigned by Wordfence as CNA. It affects the Nokri – Job Board WordPress Theme, a commercial theme sold on ThemeForest, and it is scored 9.8 critical on CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The record says the theme “is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokri_reset_password() function, which allows empty attacker-supplied reset tokens to match empty or unset sb_password_forget_token user meta values. This makes it possible for unauthenticated attackers to reset the password of any user, including administrators, and gain access to their account.”
That is a complete, unauthenticated takeover of any WordPress site running the theme. No account, no interaction, no timing window — send a reset with an empty token against a user whose stored token is empty, which is the state of every user who has not recently requested a reset.
This has been published before
On March 1, 2025, NVD published CVE-2024-12824, also assigned by Wordfence, also scored 9.8 on the identical vector, also for this theme. Its description reads: the theme “is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user’s password, including administrators, and leverage that to gain access to their account.”
Strip the wording and the two records describe the same defect: an empty password-reset token is accepted as valid, so any unauthenticated visitor can set any user’s password. The 2025 record was scoped to versions up to 1.6.2. Today’s is scoped to versions up to 1.6.6. Versions 1.6.3 through 1.6.6 fall only under the new one.
Between them sits a third disclosure. Wordfence also carries an advisory for “Nokri – Job Board WordPress Theme <= 1.6.3 – Authenticated Subscriber Privilege Escalation via Account Takeover” — a variant of the same account-takeover behavior requiring a subscriber account rather than none at all.
Neither the new CVE record nor its Wordfence entry mentions CVE-2024-12824. A defender reading CVE-2026-18550 today has no indication from the record that this ground was covered eighteen months ago.
The fix, and what the release notes say about it
Version 1.6.7 shipped on August 18, 2026 — two weeks before the CVE appeared. The ThemeForest listing shows the theme was last updated on August 19, 2026, and shows 2,068 sales.
The 1.6.7 changelog is more forthcoming than most in this pattern, and still does not say what happened. Under “Improved,” it lists four items: “Strengthened access control to ensure resumes, applicant details, portfolio images, and account members are accessible only to authorized users.” “Hardened file upload endpoints by requiring authentication.” “Improved input validation for job listings and profile fields to prevent malicious input.” And, fourth: “Hardened database queries and token generation for enhanced security.”
Bullet four is the administrator takeover. Bullet two — “Hardened file upload endpoints by requiring authentication” — describes a separate unauthenticated file upload issue for which no public CVE record currently exists.
For comparison, the prior release, 1.6.6 on July 4, 2026, itemizes eight new homepage layouts, video and portfolio sections for candidate profiles, a working-hours section, a featured-candidates grid shortcode, and background color options for premium jobs. The vendor is capable of specificity. It spends it on features.
Why it matters
The recurrence is the story, and it should be stated with the uncertainty intact. There are two readings and the public record does not settle between them. Either the February 2025 fix was incomplete — closing one path into nokri_reset_password() while leaving another — or the empty-token check was removed or bypassed again somewhere in the 1.6.3 to 1.6.6 development line. Both are common. Only one of them is a regression in the strict sense. What is not in dispute is that a theme sold to 2,068 buyers accepted an empty password-reset token as valid in March 2025, and accepted an empty password-reset token as valid in August 2026.
Version 1.6.6 is the release that makes this concrete. It shipped on July 4, 2026, sixteen months after the first CVE, carrying eight new homepage layouts and a portfolio gallery — and the same authentication defect the vendor had already been told about and already shipped a fix for. Feature work moved. The check did not hold.
The distribution channel is what turns a 9.8 into an operational problem rather than a one-day patch cycle. Themes bought on ThemeForest do not update through the WordPress.org channel that powers one-click and automatic updates for free plugins and themes. Buyers update through the vendor’s own mechanism, through Envato’s marketplace plugin if they installed it, or by uploading a zip by hand. Many small sites do none of the three. A job board theme is bought once, configured, and left running, and its administrators are frequently the same people who run the business rather than anyone who reads a CVE feed.
Which brings the release notes back into it. This is now the fifth instance in five days where a release closing a critical, usually unauthenticated flaw is described in the vendor’s own public changelog as hardening or validation: GiveWP’s 10.0 unauthenticated RCE as “additional hardening”, TranslatePress omitting the fixing release from its changelog entirely, Eclipse Theia logging an agent-mode workspace escape as a refactor, and this morning WPLP Cookie Consent describing an unauthenticated file upload that reaches code execution as “improved validation”.
The charitable reading is the right one and is worth repeating: a marketplace changelog is sales copy written for prospective buyers, not an operator advisory. Nobody is hiding anything — the accurate description exists, in the CNA record, and it arrived today. But it arrived fourteen days after the fix, and in the interval the only document an existing buyer could read said “Improved.” “Hardened database queries and token generation” reads as maintenance. “An unauthenticated visitor can take over your administrator account” reads as tonight. Those two sentences describe the same commit and produce entirely different update behavior in the population that has to act on them.
What to do
Update Nokri to 1.6.7. Any version at or below 1.6.6 is affected. If the theme was installed by uploading a zip, check the installed version in Appearance → Themes rather than assuming an updater has run — premium themes frequently report an available update they never apply.
Before assuming the update is enough, audit administrator accounts. This flaw leaves no distinctive trace beyond a password change, so look for administrator or editor accounts created or modified since roughly March 2025, unexpected password-change events in any security plugin log, and users whose email address differs from the one your records show. Rotate administrator credentials after updating, not before.
Check for uploaded files with executable extensions in the uploads directory, given that 1.6.7 also closes unauthenticated file upload endpoints. Anything PHP under wp-content/uploads warrants investigation regardless of date.
If you cannot update immediately, a web application firewall rule blocking requests to the theme’s password-reset endpoint that carry an empty or absent token parameter is a workable stopgap. It is not a substitute for 1.6.7.
Sourcing note
CVE-2026-18550 and CVE-2024-12824 — descriptions, scores, vectors, CWEs, publication dates, and references — were read from the NVD API. The version numbers, release dates, sales figure, and changelog text for 1.6.6 and 1.6.7 were read from the theme’s ThemeForest listing, which is the vendor’s own published record. The existence of the intermediate Wordfence advisory for versions up to 1.6.3 is taken from Wordfence’s own threat intelligence listing.
Not established: Wordfence’s individual advisory pages for both CVEs would not render for this run, so the researcher credits, disclosure timelines, and any Wordfence firewall-rule dates are not reported here. Whether the 2025 fix was incomplete or the defect was reintroduced is unresolved, and this story does not assert either; a code comparison between 1.6.2, 1.6.3, and 1.6.6 would settle it, and the theme is not publicly distributed. No exploitation of CVE-2026-18550 has been reported, it does not appear in CISA’s Known Exploited Vulnerabilities catalog, and no federal deadline attaches to it. The unauthenticated file upload implied by the 1.6.7 changelog has no CVE record found in this check; that reading is inferred from the vendor’s own wording, not from an advisory.