The Orderable WordPress plugin fails to verify user permissions when performing the install_plugin action, allowing any user with Subscriber-level access or higher to upload and activate arbitrary plugins. The lack of a capability check can lead to Remote Code Execution if a malicious plugin is installed. This flaw is categorized as Missing Authorization (CWE-862).

The vulnerability affects the Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin from the Orderable vendor, specifically all releases up to version 1.20.0. Administrators and subscribers on affected WordPress sites using these versions are at risk.

With a CVSS base score of 8.8, the flaw represents a high severity risk. The EPSS indicates a low probability of exploitation at this time, and the vulnerability is not part of the CISA Known Exploited Vulnerabilities catalog. Nevertheless, because the technique only requires a Subscriber role – a common role on many WordPress installations – an attacker could easily exploit the flaw if credentials are compromised or if social engineering succeeds. The likely attack vector is an authenticated user who leverages the plugin installation endpoint without proper authorization checks.