The vulnerability CVE-2026-7266 affects SourceCodester Pizzafy Ecommerce System 1.0. It is an SQL injection issue in the save_order function located in /admin/ajax.php?action=save_order. The vulnerability arises from improper sanitization of the ID parameter, enabling remote attackers to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data access or manipulation. The CVSS 4.0 base score is 5.3, indicating medium severity. No official patch or vendor advisory is currently available, and the exploit is publicly known.

Successful exploitation of this vulnerability could allow an attacker to perform unauthorized SQL queries on the database, potentially leading to data disclosure, modification, or deletion. The medium CVSS score reflects limited privileges required and low complexity of attack, but with limited scope and impact. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint, applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter, and reviewing application input validation. Monitor vendor channels for updates and patches.