CVE-2026-0974 in Orderable Plugin
Summary
by MITRE • 02/19/2026
The Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the 'install_plugin' function in all versions up to, and including, 1.20.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary plugins, which can lead to Remote Code Execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The Orderable WordPress plugin represents a critical security vulnerability that exposes WordPress installations to unauthorized plugin installation attacks through a fundamental capability check failure in its 'install_plugin' function. This vulnerability affects all versions up to and including 1.20.0, creating a persistent risk for WordPress sites that rely on this restaurant ordering system. The flaw manifests as an insufficient authorization mechanism that fails to verify whether authenticated users possess the necessary privileges before permitting plugin installation operations.
The technical implementation of this vulnerability stems from the absence of proper capability validation within the plugin's core functionality. An attacker with Subscriber-level access or higher can exploit this weakness to install arbitrary plugins directly through the WordPress admin interface, bypassing normal security controls that typically restrict such operations to administrators or users with elevated privileges. This missing authorization check creates a direct pathway for privilege escalation and potential system compromise, as the installed plugins may contain malicious code designed to execute commands remotely on the target server.
The operational impact of this vulnerability extends beyond simple unauthorized plugin installation, creating significant risks for WordPress site security and integrity. Attackers can leverage this weakness to deploy malware, backdoor access tools, or other malicious components that could lead to complete system compromise and remote code execution. The vulnerability essentially allows authenticated attackers to transform their limited subscriber privileges into a means of installing arbitrary software on the target system, potentially enabling data exfiltration, service disruption, or further lateral movement within network environments where WordPress is deployed.
Security professionals should note this vulnerability aligns with CWE-284 (Improper Access Control) and represents a clear violation of principle of least privilege in WordPress plugin architecture. The risk assessment indicates this vulnerability falls within ATT&CK technique T1190 (Exploit Public-Facing Application) as it exploits a weakness in a publicly accessible WordPress plugin component. Organizations should immediately implement mitigation measures including immediate plugin updates to versions that address the capability check deficiency, and consider implementing additional access controls through custom user role definitions that restrict plugin installation capabilities even for users with elevated privileges.
The remediation process requires administrators to upgrade to patched versions of the Orderable plugin while maintaining comprehensive monitoring of system logs for unauthorized plugin installation attempts. Additional defensive measures should include implementing web application firewalls, restricting administrative access through network segmentation, and conducting regular security audits of installed plugins to identify potential malicious installations. The vulnerability demonstrates the critical importance of proper capability validation in WordPress plugin development and serves as a reminder that even seemingly innocuous functionality can create significant security risks when authorization controls are improperly implemented.