CVE-2026-0974: RCE in Orderable Restaurant Plugin
Platform
wordpress
Component
orderable
CVE-2026-0974 describes a critical Remote Code Execution (RCE) vulnerability within the Orderable – Restaurant & Food Ordering System plugin for WordPress. This flaw allows authenticated attackers, even those with Subscriber-level access, to install arbitrary plugins, effectively gaining control over the WordPress installation. The vulnerability affects versions of the plugin up to and including 1.20.0. A fix is available in subsequent versions.
Detecteer deze CVE in je project
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Impact en Aanvalsscenarioswordt vertaald…
The impact of CVE-2026-0974 is significant due to its potential for Remote Code Execution. A successful exploit allows an attacker to install malicious plugins, which can then be used to compromise the entire WordPress site. This could involve data theft, website defacement, malware distribution, or complete server takeover. The attacker only needs Subscriber-level access, making it relatively easy to exploit. The blast radius extends to all data stored on the WordPress site, including customer information, order details, and potentially database credentials. This vulnerability shares similarities with other plugin installation vulnerabilities where inadequate access controls are present.
Uitbuitingscontextwordt vertaald…
CVE-2026-0974 was published on 2026-02-18. Its severity is rated HIGH with a CVSS score of 8.8. There is currently no indication of this vulnerability being actively exploited in the wild, nor is it listed on KEV or EPSS. Public Proof-of-Concept (POC) code is likely to emerge given the ease of exploitation and the high impact. Monitor security advisories and vulnerability databases for updates.
Dreigingsinformatie
Exploit Status
EPSS
0.28% (51% percentiel)
CISA SSVC
CVSS-vector
Wat betekenen deze metrics?
- Attack Vector
- Netwerk — op afstand uitbuitbaar via internet. Geen fysieke of lokale toegang vereist.
- Attack Complexity
- Laag — geen speciale voorwaarden vereist. Betrouwbaar uitbuitbaar.
- Privileges Required
- Laag — elk geldig gebruikersaccount is voldoende.
- User Interaction
- Geen — automatische en stille aanval. Slachtoffer doet niets.
- Scope
- Ongewijzigd — impact beperkt tot het kwetsbare component.
- Confidentiality
- Hoog — volledig verlies van vertrouwelijkheid. Aanvaller kan alle gegevens lezen.
- Integrity
- Hoog — aanvaller kan alle gegevens schrijven, aanpassen of verwijderen.
- Availability
- Hoog — volledige crash of uitputting van resources. Totale denial of service.
Getroffen Software
Zwakheidsclassificatie (CWE)
Tijdlijn
- Gereserveerd
- Gepubliceerd
- Gewijzigd
- EPSS bijgewerkt
Mitigatie en Workaroundswordt vertaald…
The primary mitigation for CVE-2026-0974 is to upgrade the Orderable plugin to a version that addresses the vulnerability. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting plugin installation capabilities to only administrators. WordPress administrators can use a plugin like 'Limit Login Attempts' to further restrict access and monitor for suspicious login attempts. Regularly review installed plugins and remove any that are unnecessary or outdated. After upgrading, verify the fix by attempting to install a plugin with a Subscriber-level account – the installation should be denied.
Hoe te verhelpen
Geen bekende patch beschikbaar. Bestudeer de details van de kwetsbaarheid grondig en pas mitigaties toe op basis van de risicotolerantie van uw organisatie. Het kan het beste zijn om de getroffen software te verwijderen en een vervanging te vinden.
Veelgestelde vragenwordt vertaald…
What is CVE-2026-0974 — RCE in Orderable Restaurant Plugin?
CVE-2026-0974 is a Remote Code Execution vulnerability in the Orderable plugin for WordPress, allowing authenticated attackers to install arbitrary plugins and potentially take control of the site. It has a HIGH severity rating (CVSS 8.8).
Am I affected by CVE-2026-0974 in Orderable Restaurant Plugin?
You are affected if you are using the Orderable plugin version 1.20.0 or earlier. Check your plugin version and upgrade immediately if vulnerable.
How do I fix CVE-2026-0974 in Orderable Restaurant Plugin?
Upgrade the Orderable plugin to the latest available version. If upgrading is not immediately possible, restrict plugin installation capabilities to administrators as a temporary workaround.
Is CVE-2026-0974 being actively exploited?
There is currently no public evidence of CVE-2026-0974 being actively exploited, but the ease of exploitation suggests it could become a target.
Where can I find the official Orderable advisory for CVE-2026-0974?
Refer to the Orderable plugin developer's website or the WordPress plugin repository for the latest advisory and update information regarding CVE-2026-0974.
Is jouw project getroffen?
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Detecteer deze CVE in je project
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Scan nu uw WordPress project — geen account
Upload een manifest (composer.lock, package-lock.json, WordPress pluginlijst…) of plak uw componentenlijst. U ontvangt direct een kwetsbaarheidsrapport. Een bestand uploaden is slechts het begin: met een account krijgt u continue monitoring, Slack/e-mail alerts, multi-project en white-label rapporten.
Sleep uw afhankelijkheidsbestand hierheen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...