Is there a public PoC exploit available for CVE-2026-7266?

Yes, a public proof-of-concept exploit is available for CVE-2026-7266. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Pizzafy Ecommerce System CVE-2026-7266

Q: What is the CVSS score of CVE-2026-7266?

CVE-2026-7266 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26032 LOW

SQL Injection (CWE-89)

2026-04-28 VulDB

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 28, 2026 - 12:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 28, 2026 - 12:00 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 11:45 euvd

EUVD-2026-26032

Analysis Generated

Apr 28, 2026 - 11:45 vuln.today

CVE Published

Apr 28, 2026 - 10:45 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. The impacted element is the function save_order of the file /admin/ajax.php?action=save_order. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in the save_order function at /admin/ajax.php?action=save_order, potentially enabling data exfiltration, modification, or deletion. Publicly available exploit code exists and the vulnerability carries a CVSS score of 6.3 with low complexity, indicating moderate real-world risk despite requiring login credentials.

Technical ContextAI

The vulnerability exploits improper input validation in a PHP-based e-commerce platform. The save_order AJAX handler in /admin/ajax.php fails to properly sanitize or parameterize SQL queries when processing the ID parameter, allowing attackers to inject arbitrary SQL syntax. This is a classic CWE-89 SQL injection flaw where user-controlled input is directly concatenated into SQL statements without preparation. The affected product is identified by CPE cpe:2.3:a:sourcecodester:pizzafy_ecommerce_system:*:*:*:*:*:*:*:* with no version constraints specified, indicating potentially all versions are vulnerable, though only 1.0 is explicitly mentioned in the description.

RemediationAI

No vendor-released patch identified at time of analysis. As immediate mitigation, apply input validation and parameterized query frameworks to the save_order function in /admin/ajax.php - specifically, use prepared statements with bound parameters for all ID parameter handling to prevent SQL injection. Additionally, restrict access to /admin/ajax.php to specific trusted IP ranges or VPN, enforce strong admin authentication with multi-factor authentication (MFA) to reduce likelihood of credential compromise, and implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in the ID parameter (trade-off: may require tuning to avoid false positives). Monitor database logs for unusual SQL queries originating from admin sessions. For organizations unable to patch immediately, consider disabling the save_order AJAX functionality if not critical to operations, or deploying application-level query filtering to detect injection attempts.