CVE-2026-0974: WordPress Orderable Plugin Auth Bypass Flaw

CVE-2026-0974 Overview

CVE-2026-0974 is an authorization bypass vulnerability in the Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin for WordPress. The vulnerability exists due to a missing capability check on the install_plugin function in all versions up to and including 1.20.0. This flaw enables authenticated attackers with Subscriber-level access or above to install arbitrary plugins, which can ultimately lead to Remote Code Execution (RCE) on the affected WordPress site.

Critical Impact

Authenticated attackers with minimal privileges (Subscriber-level) can install malicious plugins, potentially achieving full Remote Code Execution on vulnerable WordPress installations.

Affected Products

• Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin versions up to and including 1.20.0
• WordPress sites running vulnerable versions of the Orderable plugin
• Sites with registered Subscriber-level or higher user accounts

Discovery Timeline

• 2026-02-19 - CVE-2026-0974 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-0974

Vulnerability Analysis

This vulnerability falls under CWE-862 (Missing Authorization), a critical weakness where the application fails to perform proper authorization checks before executing privileged operations. The install_plugin function within the Orderable plugin's AJAX handler does not verify that the requesting user has the appropriate WordPress capabilities (such as install_plugins or activate_plugins) before proceeding with plugin installation.

WordPress employs a role-based access control system where different user roles have specific capabilities. The Subscriber role is intended to have minimal permissions—typically limited to reading content and managing their own profile. However, due to the missing capability check in the Orderable plugin, any authenticated user can invoke the install_plugin AJAX action and install arbitrary plugins from the WordPress repository or external sources.

Root Cause

The root cause of this vulnerability is the absence of a proper current_user_can() check within the install_plugin function located in the class-ajax.php file. The vulnerable code path allows the function to execute plugin installation logic without first verifying that the authenticated user possesses the required install_plugins capability. This oversight permits low-privileged users to perform administrative actions that should be restricted to site administrators.

Attack Vector

The attack is network-accessible and requires low-privilege authentication (Subscriber-level account). An attacker can exploit this vulnerability through the following attack flow:

1. Obtain Low-Privilege Access: The attacker registers or compromises a Subscriber-level account on the target WordPress site
2. Craft Malicious AJAX Request: The attacker constructs an AJAX request to the WordPress admin-ajax.php endpoint targeting the vulnerable install_plugin action
3. Install Malicious Plugin: The attacker specifies a malicious plugin (either from a controlled repository or a known vulnerable plugin) to be installed
4. Achieve Code Execution: Once the malicious plugin is installed and activated, the attacker can execute arbitrary PHP code on the server

The vulnerable code can be examined in the WordPress Plugin Code Review. The exploitation requires no user interaction and can be performed remotely over the network. For detailed vulnerability information, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-0974

Indicators of Compromise

• Unexpected plugins installed on WordPress sites, particularly those not installed by administrators
• AJAX requests to admin-ajax.php with action=install_plugin from non-administrative users
• Unusual plugin installation activity in WordPress audit logs from Subscriber-level accounts
• Presence of unknown or suspicious plugins in the wp-content/plugins/ directory

Detection Strategies

• Monitor WordPress AJAX endpoints for plugin installation requests from low-privileged user sessions
• Implement file integrity monitoring on the wp-content/plugins/ directory to detect unauthorized additions
• Review WordPress activity logs for plugin installation events correlated with non-administrator user IDs
• Deploy Web Application Firewall (WAF) rules to detect and block unauthorized plugin installation attempts

Monitoring Recommendations

• Enable comprehensive WordPress audit logging to track all plugin installation and activation events
• Configure alerts for any plugin installations performed by users without administrator privileges
• Regularly audit user accounts and remove unnecessary Subscriber or higher-level accounts
• Monitor server access logs for suspicious POST requests to admin-ajax.php

How to Mitigate CVE-2026-0974

Immediate Actions Required

• Update the Orderable plugin to a version newer than 1.20.0 that includes the security fix
• Audit your WordPress site for any unauthorized plugins that may have been installed
• Review user accounts and remove or disable unnecessary Subscriber-level accounts
• Temporarily disable the Orderable plugin if an update is not immediately available

Patch Information

Update the Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin to the latest patched version available through the WordPress plugin repository. The security fix adds proper capability checks to the install_plugin function, ensuring that only users with the install_plugins capability can execute plugin installations.

Administrators should verify the update by checking that the plugin version is greater than 1.20.0. After updating, review installed plugins to ensure no unauthorized plugins were added during the vulnerability window.

Workarounds

• Implement a Web Application Firewall (WAF) rule to block AJAX requests to the install_plugin action from non-administrator users
• Disable WordPress user registration if not required for business operations
• Use a security plugin to restrict AJAX endpoint access based on user capabilities
• Consider temporarily deactivating the Orderable plugin until the official patch is applied

# Configuration example - Verify Orderable plugin version
wp plugin list --name=orderable --fields=name,version,status

# Check for recently installed plugins
wp plugin list --fields=name,status --format=table | head -20

# Audit user roles for potential attacker accounts
wp user list --role=subscriber --fields=ID,user_login,user_registered