Attack Chain

1. Attacker authenticates to the target WordPress site with low-privilege Subscriber credentials.
2. Attacker crafts an HTTP POST request targeting the vulnerable 'nokri_account_member_permissions' function.
3. The vulnerable theme code fails to verify if the requesting user possesses administrative or sufficient employer-level permissions.
4. Attacker injects parameters to add a new Subscriber user with employer-level account member privileges.
5. Attacker logs into or uses the elevated employer member account to access user profile modification features.
6. Attacker updates the email address of a target Administrator account to an attacker-controlled email address.
7. Attacker initiates a standard 'Forgot Password' request for the hijacked Administrator account.
8. Attacker receives the password reset token at the attacker-controlled email address to complete the account takeover.

Impact

Successful exploitation of this vulnerability leads to full administrative account takeover. Attackers can gain control over the entire WordPress site, potentially resulting in data exfiltration, unauthorized content modification, installation of malicious plugins, or complete site defacement. The scope is limited to WordPress installations utilizing the Nokri - Job Board WordPress Theme versions 1.6.4 and below.

Recommendation

Prioritize the immediate update of the Nokri - Job Board WordPress Theme to the latest available version provided by the vendor. In environments where immediate patching is not possible, implement strict access controls on registration and user modification endpoints. Enable detailed server-side request logging to monitor for unauthorized calls to the 'nokri_account_member_permissions' function.