Is there a public PoC exploit available for CVE-2026-5330?

Yes, a public proof-of-concept exploit is available for CVE-2026-5330. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5330

Q: What is the CVSS score of CVE-2026-5330?

CVE-2026-5330 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18215 MEDIUM

Improper Access Control (CWE-284)

2026-04-02 VulDB

GHSA-727f-vwj6-7jvh

PHP Authentication Bypass Best Courier Management System Sourcecodester

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 13:15 euvd

EUVD-2026-18215

Analysis Generated

Apr 02, 2026 - 13:15 vuln.today

CVE Published

Apr 02, 2026 - 12:45 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was found in SourceCodester/mayuri_k Best Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=delete_user of the component User Delete Handler. Performing a manipulation of the argument ID results in improper access controls. The attack may be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

Improper access controls in SourceCodester Best Courier Management System 1.0 allow unauthenticated remote attackers to delete users by manipulating the ID parameter in the /ajax.php?action=delete_user endpoint, bypassing authentication requirements. The vulnerability has publicly available exploit code and impacts all versions of the affected software with a CVSS 6.9 score reflecting moderate integrity impact through an easily exploitable network vector.

Technical ContextAI

The vulnerability exists in the User Delete Handler component of the Best Courier Management System, a PHP-based web application. The /ajax.php endpoint implements a delete_user action that fails to properly validate or enforce access controls when processing the ID parameter. CWE-284 (Improper Access Control) indicates the root cause is an authorization bypass where the application does not verify the requesting user has permission to delete the specified user account. The vulnerability is unauthenticated (PR:N per CVSS vector), meaning no valid credentials are required to trigger the malicious action. The affected products are identified via CPE strings for both SourceCodester and Mayuri K vendors, indicating either rebranded versions or multiple distribution channels of the same codebase.

RemediationAI

Immediately upgrade or patch the Best Courier Management System to a version that implements proper access control validation on the user delete handler. Verify the vendor (SourceCodester or Mayuri K) has released a patched version and apply it after testing. As an interim measure, restrict network access to the /ajax.php endpoint using a Web Application Firewall (WAF) or reverse proxy to require authentication prior to reaching the vulnerable handler, and implement input validation to reject malformed or out-of-range ID parameters. Review audit logs for evidence of unauthorized user deletion attempts. Vendor advisory and additional technical details are available at https://vuldb.com/vuln/354664.