This vulnerability affects the Best Courier Management System version 1.0 by SourceCodester. The issue lies in the improper enforcement of access controls in the user deletion functionality accessed via /ajax.php?action=delete_user. By manipulating the ID parameter, an unauthenticated remote attacker can perform unauthorized user deletions. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on confidentiality and availability. No vendor advisory or patch information is provided.

An attacker can remotely delete user accounts without proper authorization, potentially disrupting system operations or causing denial of service related to user management. The impact is limited to the user deletion functionality and does not indicate broader system compromise or data leakage. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint where possible and monitor for suspicious activity related to user deletions. Avoid exposing the vulnerable functionality to untrusted networks.