The vulnerability CVE-2026-7083 affects the likeadmin-likeshop likeadmin_php product versions 1.9.0 through 1.9.6. It is located in the queryResult function of the server\app\adminapi\lists\tools\DataTableLists.php file, part of the Admin API's dataTable component. The flaw allows an attacker with high privileges to perform SQL injection remotely by manipulating input parameters processed by this function. The vulnerability has been publicly disclosed, but no official fix or patch has been released by the vendor as of the publication date. The CVSS 4.0 base score is 5.1, indicating medium severity, with network attack vector, low complexity, and no user interaction required.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data disclosure, data modification, or other impacts associated with SQL injection. However, the attack requires high privileges, which limits the scope of exploitation. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, restrict access to the affected Admin API component to trusted users only and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the vulnerable function.