Unauthorized Plugin Installation in WordPress Restaurant Online Ordering System
CVE-2026-0974

8.8HIGH

Key Information:

Vendor

WordPress
Status
Orderable – WordPress Restaurant Online Ordering System And Food Ordering Plugin
Vendor
CVE Published:
19 February 2026

What is CVE-2026-0974?

The Orderable plugin for WordPress, an online ordering and food management solution, is susceptible to a critical vulnerability due to a lack of capability checks in the 'install_plugin' function. This flaw enables authenticated users, possessing at least Subscriber-level access, to install any plugin of their choice. Such an attack may lead to Remote Code Execution, posing a severe risk to the integrity and security of affected WordPress sites. Users are advised to update to the latest version of the plugin immediately to mitigate potential threats.

Affected Version(s)

Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin 0 <= 1.20.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/orderable/trun...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Athiwat Tiprasaharn
.