Online Food Ordering System EUVD-2026-110538

The specific prerequisite is a reachable instance of SourceCodester Online Food Ordering System 1.0 whose admin/delete_admin.php endpoint is accessible over the network; because the endpoint is missing an authentication/authorization check (CWE-287), an attacker simply supplies the ID parameter with no login. Per the CVSS vector (PR:N/UI:N/AC:L), exploitation is unauthenticated, needs no user interaction, and works against the default configuration. The practical limiting factors are: the attacker must be able to route to the application's admin path, the product is a niche demo-grade PHP app with tiny deployment scale, and the impact is bounded to deletion of administrator records (integrity/availability low) with no confidentiality exposure.

This is a genuine but modest-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which aligns with the CWE-287 missing-authentication root cause and the description's statement that the attack can be initiated remotely. However, the impact is deliberately scoped as partial: only VI:L and VA:L (integrity and availability low), with VC:N - consistent with an endpoint that deletes admin records rather than exposing data or granting code execution, yielding a Medium 5.5 base score. The signals are internally consistent rather than conflicting: EPSS is low (0.57%, 47th percentile), the vuln is NOT on CISA KEV, and SSVC records Exploitation=poc (not active), Automatable=yes, Technical Impact=partial. The vuln.today Decision label is 'this_month' - a routine-patch priority, not act_now/emergency. The one meaningful amplifier is Automatable=yes combined with no authentication, meaning the endpoint can be hit opportunistically at scale; but the very limited real-world footprint of this product (a SourceCodester demo/hobby PHP application) and the bounded impact keep overall risk low. Treat as scheduled remediation, not an emergency.

A remote, unauthenticated attacker who can reach the application sends a crafted request to admin/delete_admin.php supplying an ID value, and because the endpoint performs no authentication check, the targeted administrator record is deleted. A public PoC reference exists (CyberShailendra GitHub repo) though it is not verified as working exploit code; the CVE description states the exploit has been publicly disclosed. The low attack complexity and lack of required privileges or user interaction make the request trivial to replay.