Analyse in behandelingCVE-2026-0974

CVE-2026-0974: RCE in Orderable Restaurant Plugin

Platform

wordpress

Component

orderable

CVE-2026-0974 describes a critical Remote Code Execution (RCE) vulnerability within the Orderable – Restaurant & Food Ordering System plugin for WordPress. This flaw allows authenticated attackers, even those with Subscriber-level access, to install arbitrary plugins, effectively gaining control over the WordPress installation. The vulnerability affects versions of the plugin up to and including 1.20.0. A fix is available in subsequent versions.

WordPress

Detecteer deze CVE in je project

Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.

Impact en Aanvalsscenarioswordt vertaald…

The impact of CVE-2026-0974 is significant due to its potential for Remote Code Execution. A successful exploit allows an attacker to install malicious plugins, which can then be used to compromise the entire WordPress site. This could involve data theft, website defacement, malware distribution, or complete server takeover. The attacker only needs Subscriber-level access, making it relatively easy to exploit. The blast radius extends to all data stored on the WordPress site, including customer information, order details, and potentially database credentials. This vulnerability shares similarities with other plugin installation vulnerabilities where inadequate access controls are present.

Uitbuitingscontextwordt vertaald…

CVE-2026-0974 was published on 2026-02-18. Its severity is rated HIGH with a CVSS score of 8.8. There is currently no indication of this vulnerability being actively exploited in the wild, nor is it listed on KEV or EPSS. Public Proof-of-Concept (POC) code is likely to emerge given the ease of exploitation and the high impact. Monitor security advisories and vulnerability databases for updates.

Dreigingsinformatie

Exploit Status

Proof of ConceptOnbekend
CISA KEVNO
InternetblootstellingHoog

EPSS

0.28% (51% percentiel)

CISA SSVC

Exploitatienone
Automatiseerbaarno
Technische Impacttotal

CVSS-vector

DREIGINGSINFORMATIE· CVSS 3.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H8.8HIGHAttack VectorNetworkHoe de aanvaller het doel bereiktAttack ComplexityLowVereiste omstandigheden om te exploiterenPrivileges RequiredLowVereist authenticatieniveau voor aanvalUser InteractionNoneOf het slachtoffer actie moet ondernemenScopeUnchangedImpact buiten het getroffen onderdeelConfidentialityHighRisico op blootstelling van gevoelige dataIntegrityHighRisico op ongeautoriseerde gegevenswijzigingAvailabilityHighRisico op verstoring van dienstennextguardhq.com · CVSS v3.1 Basisscore
Wat betekenen deze metrics?
Attack Vector
Netwerk — op afstand uitbuitbaar via internet. Geen fysieke of lokale toegang vereist.
Attack Complexity
Laag — geen speciale voorwaarden vereist. Betrouwbaar uitbuitbaar.
Privileges Required
Laag — elk geldig gebruikersaccount is voldoende.
User Interaction
Geen — automatische en stille aanval. Slachtoffer doet niets.
Scope
Ongewijzigd — impact beperkt tot het kwetsbare component.
Confidentiality
Hoog — volledig verlies van vertrouwelijkheid. Aanvaller kan alle gegevens lezen.
Integrity
Hoog — aanvaller kan alle gegevens schrijven, aanpassen of verwijderen.
Availability
Hoog — volledige crash of uitputting van resources. Totale denial of service.

Getroffen Software

Componentorderable
Leverancierwordfence
Maximumversie1.20.0

Zwakheidsclassificatie (CWE)

Tijdlijn

  1. Gereserveerd
  2. Gepubliceerd
  3. Gewijzigd
  4. EPSS bijgewerkt

Mitigatie en Workaroundswordt vertaald…

The primary mitigation for CVE-2026-0974 is to upgrade the Orderable plugin to a version that addresses the vulnerability. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting plugin installation capabilities to only administrators. WordPress administrators can use a plugin like 'Limit Login Attempts' to further restrict access and monitor for suspicious login attempts. Regularly review installed plugins and remove any that are unnecessary or outdated. After upgrading, verify the fix by attempting to install a plugin with a Subscriber-level account – the installation should be denied.

Hoe te verhelpen

Geen bekende patch beschikbaar. Bestudeer de details van de kwetsbaarheid grondig en pas mitigaties toe op basis van de risicotolerantie van uw organisatie. Het kan het beste zijn om de getroffen software te verwijderen en een vervanging te vinden.

Veelgestelde vragenwordt vertaald…

What is CVE-2026-0974 — RCE in Orderable Restaurant Plugin?

CVE-2026-0974 is a Remote Code Execution vulnerability in the Orderable plugin for WordPress, allowing authenticated attackers to install arbitrary plugins and potentially take control of the site. It has a HIGH severity rating (CVSS 8.8).

Am I affected by CVE-2026-0974 in Orderable Restaurant Plugin?

You are affected if you are using the Orderable plugin version 1.20.0 or earlier. Check your plugin version and upgrade immediately if vulnerable.

How do I fix CVE-2026-0974 in Orderable Restaurant Plugin?

Upgrade the Orderable plugin to the latest available version. If upgrading is not immediately possible, restrict plugin installation capabilities to administrators as a temporary workaround.

Is CVE-2026-0974 being actively exploited?

There is currently no public evidence of CVE-2026-0974 being actively exploited, but the ease of exploitation suggests it could become a target.

Where can I find the official Orderable advisory for CVE-2026-0974?

Refer to the Orderable plugin developer's website or the WordPress plugin repository for the latest advisory and update information regarding CVE-2026-0974.

Is jouw project getroffen?

Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.

WordPress

Detecteer deze CVE in je project

Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.

livefree scan

Scan nu uw WordPress project — geen account

Upload een manifest (composer.lock, package-lock.json, WordPress pluginlijst…) of plak uw componentenlijst. U ontvangt direct een kwetsbaarheidsrapport. Een bestand uploaden is slechts het begin: met een account krijgt u continue monitoring, Slack/e-mail alerts, multi-project en white-label rapporten.

Manual scanSlack/email alertsscanZone.capMonitorWhite-label reports

Sleep uw afhankelijkheidsbestand hierheen

composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...