Executive brief
The Orderable plugin for WordPress, which manages restaurant online ordering, contains a security flaw that allows low-level users to install unauthorized software on the website. An attacker with a basic account (such as a customer or subscriber) could exploit this to take full control of the server, potentially leading to the theft of customer data or a complete site shutdown. This vulnerability poses a significant risk to business operations and data integrity.
Technical details
The Orderable plugin for WordPress is vulnerable to a missing authorization check (CWE-862) within the 'install_plugin' function of the AJAX handler. This flaw exists in all versions up to and including 1.20.0. An authenticated attacker with Subscriber-level permissions or higher can trigger this function to install arbitrary plugins from the WordPress repository. By installing a plugin with malicious functionality or known vulnerabilities, the attacker can escalate their privileges to achieve Remote Code Execution (RCE) on the underlying server. A patch has been released in subsequent versions to implement proper capability checks.
Affected products
- Orderable Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin Up to, and including, 1.20.0
Timeline
- 2026-02-19: disclosed
- 2026-02-19: advisory