CVE-2026-0974 is a missing authorization vulnerability (CWE-862) in the Orderable WordPress Restaurant & Food Ordering System plugin. The flaw exists because the 'install_plugin' function lacks proper capability checks, enabling authenticated users with low privileges (Subscriber and above) to install arbitrary plugins. This can escalate to remote code execution on the affected WordPress site. The vulnerability affects all versions up to and including 1.20.0. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with Subscriber-level access or higher can exploit this vulnerability to install arbitrary plugins on the WordPress site. This can lead to remote code execution, allowing full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability of the site and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for suspicious plugin installations. Avoid granting Subscriber or higher privileges to untrusted users.