CVE-2026-0974: RCE in Orderable Restaurant Plugin
Plataforma
wordpress
Componente
orderable
CVE-2026-0974 describes a critical Remote Code Execution (RCE) vulnerability within the Orderable – Restaurant & Food Ordering System plugin for WordPress. This flaw allows authenticated attackers, even those with Subscriber-level access, to install arbitrary plugins, effectively gaining control over the WordPress installation. The vulnerability affects versions of the plugin up to and including 1.20.0. A fix is available in subsequent versions.
Detecte esta CVE no seu projeto
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Impacto e Cenários de Ataquetraduzindo…
The impact of CVE-2026-0974 is significant due to its potential for Remote Code Execution. A successful exploit allows an attacker to install malicious plugins, which can then be used to compromise the entire WordPress site. This could involve data theft, website defacement, malware distribution, or complete server takeover. The attacker only needs Subscriber-level access, making it relatively easy to exploit. The blast radius extends to all data stored on the WordPress site, including customer information, order details, and potentially database credentials. This vulnerability shares similarities with other plugin installation vulnerabilities where inadequate access controls are present.
Contexto de Exploraçãotraduzindo…
CVE-2026-0974 was published on 2026-02-18. Its severity is rated HIGH with a CVSS score of 8.8. There is currently no indication of this vulnerability being actively exploited in the wild, nor is it listed on KEV or EPSS. Public Proof-of-Concept (POC) code is likely to emerge given the ease of exploitation and the high impact. Monitor security advisories and vulnerability databases for updates.
Inteligência de Ameaças
Status do Exploit
EPSS
0.28% (percentil 51%)
CISA SSVC
Vetor CVSS
O que significam essas métricas?
- Attack Vector
- Rede — explorável remotamente pela internet. Sem acesso físico ou local necessário.
- Attack Complexity
- Baixa — sem condições especiais. O atacante pode explorar de forma confiável.
- Privileges Required
- Baixo — qualquer conta de usuário válida é suficiente.
- User Interaction
- Nenhuma — ataque automático e silencioso. A vítima não faz nada.
- Scope
- Inalterado — impacto limitado ao componente vulnerável.
- Confidentiality
- Alto — perda total de confidencialidade. O atacante pode ler todos os dados.
- Integrity
- Alto — o atacante pode escrever, modificar ou excluir qualquer dado.
- Availability
- Alto — falha completa ou esgotamento de recursos. Negação de serviço total.
Software Afetado
Classificação de Fraqueza (CWE)
Linha do tempo
- Reservado
- Publicada
- Modificada
- EPSS atualizado
Mitigação e Soluções Alternativastraduzindo…
The primary mitigation for CVE-2026-0974 is to upgrade the Orderable plugin to a version that addresses the vulnerability. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting plugin installation capabilities to only administrators. WordPress administrators can use a plugin like 'Limit Login Attempts' to further restrict access and monitor for suspicious login attempts. Regularly review installed plugins and remove any that are unnecessary or outdated. After upgrading, verify the fix by attempting to install a plugin with a Subscriber-level account – the installation should be denied.
Como corrigir
Nenhum patch conhecido disponível. Por favor, revise os detalhes da vulnerabilidade em profundidade e empregue mitigações com base na tolerância ao risco da sua organização. Pode ser melhor desinstalar o software afetado e encontrar um substituto.
Perguntas frequentestraduzindo…
What is CVE-2026-0974 — RCE in Orderable Restaurant Plugin?
CVE-2026-0974 is a Remote Code Execution vulnerability in the Orderable plugin for WordPress, allowing authenticated attackers to install arbitrary plugins and potentially take control of the site. It has a HIGH severity rating (CVSS 8.8).
Am I affected by CVE-2026-0974 in Orderable Restaurant Plugin?
You are affected if you are using the Orderable plugin version 1.20.0 or earlier. Check your plugin version and upgrade immediately if vulnerable.
How do I fix CVE-2026-0974 in Orderable Restaurant Plugin?
Upgrade the Orderable plugin to the latest available version. If upgrading is not immediately possible, restrict plugin installation capabilities to administrators as a temporary workaround.
Is CVE-2026-0974 being actively exploited?
There is currently no public evidence of CVE-2026-0974 being actively exploited, but the ease of exploitation suggests it could become a target.
Where can I find the official Orderable advisory for CVE-2026-0974?
Refer to the Orderable plugin developer's website or the WordPress plugin repository for the latest advisory and update information regarding CVE-2026-0974.
Seu projeto está afetado?
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Detecte esta CVE no seu projeto
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Escaneie seu projeto WordPress agora — sem conta
Faça upload de qualquer manifesto (composer.lock, package-lock.json, lista de plugins WordPress…) ou cole sua lista de componentes. Receba um relatório de vulnerabilidades instantaneamente. Fazer upload de um arquivo é só o começo: com uma conta, você obtém monitoramento contínuo, alertas por Slack/email, relatórios multiprojeto e white-label.
Arraste e solte seu arquivo de dependências
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...