The vulnerability CVE-2026-6004 affects Simple IT Discussion Forum 1.0 by allowing an attacker to perform SQL injection through the cat_id parameter in the /delete-category.php script. This enables remote attackers to manipulate SQL queries executed by the application, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity with network attack vector, low attack complexity, and no privileges or user interaction required. No official fix or patch has been released as of the published date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, modification, or deletion. The vulnerability is remotely exploitable without authentication, increasing the risk of attack. However, the overall severity is medium, reflecting limited impact or exploit complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should consider implementing temporary mitigations such as input validation or web application firewalls to detect and block malicious SQL injection attempts targeting the cat_id parameter. Monitor vendor channels for updates and apply official patches once released.