CVE-2026-0974: 
WordPress vulnerability analysis and mitigation

CVE-2026-0974 is a missing authorization vulnerability in the Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin that allows authenticated attackers with Subscriber-level access or above to install arbitrary plugins, potentially leading to Remote Code Execution (RCE). All versions up to and including 1.20.0 are affected. The vulnerability was published on February 19, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Feedly, Wordfence).

The root cause is a missing capability check (CWE-862) on the install_plugin function within the Orderable plugin for WordPress. Because no authorization validation is performed before executing the plugin installation routine, any authenticated user — including those with the lowest default role (Subscriber) — can invoke this function over the network with low attack complexity and no user interaction required. This allows the attacker to install arbitrary, potentially malicious plugins from the WordPress plugin repository or other sources, which can then be leveraged to achieve Remote Code Execution on the underlying server (Feedly, Infinitsec).

Successful exploitation grants an authenticated attacker with minimal privileges the ability to install arbitrary plugins, effectively achieving Remote Code Execution and complete control over the affected WordPress installation. This encompasses full confidentiality, integrity, and availability impact: attackers can read or exfiltrate sensitive data (user credentials, payment information for restaurant orders), modify or delete site content, deface the website, or pivot to further attacks using the compromised server as a launchpad (Feedly).

As of the time of reporting, no public proof-of-concept exploit code has been identified and there is no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.24%, indicating a currently low probability of exploitation in the near term. The vulnerability is detectable by Qualys (detection ID 530994) and has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (Qualys). However, the low privilege requirement (Subscriber-level) and network-accessible attack vector make this an attractive target if a patch is delayed.

1. Reconnaissance: Identify WordPress sites running the Orderable plugin (versions ≤ 1.20.0) using tools like WPScan, Shodan, or by inspecting publicly accessible WordPress plugin metadata (/wp-content/plugins/orderable/).
2. Account Registration: Register or obtain a Subscriber-level (or higher) account on the target WordPress site — many restaurant/food ordering sites allow public customer account registration.
3. Authenticate: Log in to the WordPress site with the low-privilege account to obtain a valid authentication session (nonce and cookies).
4. Invoke install_plugin Function: Send a crafted authenticated HTTP POST request to the WordPress admin AJAX endpoint (e.g., wp-admin/admin-ajax.php) targeting the install_plugin action exposed by the Orderable plugin, specifying the desired plugin slug or URL.
5. Install Malicious Plugin: Supply a malicious plugin (e.g., a web shell packaged as a WordPress plugin) as the installation target. Because no capability check is enforced, the server installs and activates the plugin.
6. Achieve RCE: Access the installed malicious plugin's endpoint to execute arbitrary commands on the server, establish a reverse shell, or perform further post-exploitation activities (Feedly, Infinitsec).

• Network: Authenticated POST requests to wp-admin/admin-ajax.php with an action parameter related to plugin installation originating from low-privilege user sessions; unexpected outbound connections from the web server to external plugin repositories or attacker-controlled infrastructure.
• Logs: WordPress debug or access logs showing install_plugin AJAX action calls from Subscriber-level user accounts; entries in wp-admin/plugins.php reflecting newly installed plugins not authorized by administrators.
• File System: Presence of unexpected or unfamiliar plugin directories under /wp-content/plugins/; web shell files (e.g., .php files with eval, base64_decode, system, or exec functions) within newly created plugin folders.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) that are not part of normal WordPress operation.

Update the Orderable plugin to a version newer than 1.20.0 as soon as a patched release becomes available from the plugin vendor (Feedly). As an interim measure, restrict or disable public Subscriber-level account registration on WordPress sites running this plugin, and audit existing user accounts for unnecessary access. Deploy a Web Application Firewall (WAF) rule to monitor and block suspicious AJAX requests targeting plugin installation functions. Regularly review installed plugins and WordPress activity logs for unauthorized changes (Qualys).

Wordfence included CVE-2026-0974 in its weekly WordPress vulnerability report for the period of February 16–22, 2026, highlighting it as a notable missing authorization issue (Wordfence). The vulnerability was also picked up by security aggregators including VulDB, Vulners, and RedPacket Security shortly after disclosure, indicating moderate community awareness. The Hacker Wire shared the advisory on social media (Bluesky), contributing to broader visibility among the security community (Feedly).