Is there a public PoC exploit available for CVE-2026-7264?

Yes, a public proof-of-concept exploit is available for CVE-2026-7264. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Pizzafy Ecommerce System CVE-2026-7264

Q: What is the CVSS score of CVE-2026-7264?

CVE-2026-7264 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26027 LOW

SQL Injection (CWE-89)

2026-04-28 VulDB

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 28, 2026 - 10:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 28, 2026 - 10:15 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 10:00 euvd

EUVD-2026-26027

Analysis Generated

Apr 28, 2026 - 10:00 vuln.today

CVE Published

Apr 28, 2026 - 09:30 nvd

LOW 2.1

DescriptionCVE.org

A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function get_cart_items of the file /admin/ajax.php?action=get_cart_items. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to manipulate the ID parameter in the get_cart_items AJAX function (/admin/ajax.php?action=get_cart_items) to execute arbitrary SQL queries and extract, modify, or delete database contents. The vulnerability has a CVSS score of 6.3 with publicly available exploit code, posing moderate risk to affected installations.

Technical ContextAI

The vulnerability exists in a PHP-based e-commerce platform's AJAX endpoint. The get_cart_items function in /admin/ajax.php fails to properly sanitize or parameterize the ID argument before using it in SQL queries, violating the secure coding practice of prepared statements or input validation. This is a classic SQL injection vulnerability (CWE-89) where attacker-controlled user input is concatenated directly into SQL command strings. The CPE indicates all versions of the Pizzafy Ecommerce System are affected, suggesting the vulnerability may exist across multiple minor versions or the vendor has not released a patched version.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations should implement immediate compensating controls: (1) restrict access to /admin/ajax.php?action=get_cart_items to trusted IP addresses using web application firewall or network access control lists; (2) disable AJAX cart functionality if not actively used; (3) enforce strong, unique admin credentials and implement multi-factor authentication to reduce the likelihood of credential compromise; (4) conduct code review of the get_cart_items function and implement parameterized SQL queries or prepared statements with proper input validation; (5) monitor database access logs for suspicious SQL patterns and unusual query activity targeting cart-related tables. Contact SourceCodester directly via https://www.sourcecodester.com/ to inquire about patch availability or migrate to a maintained e-commerce platform if vendor support is unavailable. Apply database-level restrictions to limit the privileges of the application's database user account.