This vulnerability (CVE-2026-57631) is an SQL Injection issue classified under CWE-89 in the Ays Pro Popup box product. It affects versions up to 6.0.1 and arises from improper neutralization of special elements used in SQL commands, allowing an administrator with high privileges to execute unauthorized SQL commands. The CVSS 3.1 base score is 7.6, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. The impact scope is changed (S:C), with high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation has been disclosed as of the publication date.

Successful exploitation can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and partial denial of service (low availability impact). Integrity is not impacted. The vulnerability requires administrator privileges to exploit and can be triggered remotely over the network with low complexity and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity related to SQL queries in the affected product. Avoid exposing the vulnerable interface to untrusted networks if possible.