We are writing to inform you of a security vulnerability identified in the Orderable plugin earlier today. This vulnerability affects versions 1.20.0 and below of Orderable.

The Resolution: Version 1.20.1
The team was notified of a security vulnerability related to a part of Orderable’s onboarding logic. To fully resolve this issue and ensure the security of your sites, we have released an update to address it.

A missing permissions check, in the part of our onboarding logic that automatically installs WooCommerce, could potentially be mis-used to allow a standard logged-in user (such as a Subscriber) to install plugins from WordPress.org without proper authorization.

The necessary check is now in place, which resolves the vulnerability and prevents plugin installation by unauthorized users.

Required Action
Please update the Orderable plugin to the latest version (1.20.1or higher) immediately. You can do this directly from your WordPress admin dashboard by navigating to Plugins > Installed Plugins and clicking “Update Now” beneath Orderable. Updating will automatically secure your site against this issue.

To date, we have received no reports of this vulnerability being exploited in the wild; however, immediate updates are always a best practice to stay ahead of potential threats and keep your store secure.

We appreciate your continued trust in Orderable to power your online ordering business. If you need any assistance running the update or have any further questions, our support team is here to help.