This vulnerability (CVE-2026-73998) is an SQL Injection flaw classified under CWE-89 in the WP w3all phpBB product by axew3. It affects versions up to 3.0.5 and allows an attacker with network access and low privileges to inject SQL commands due to improper sanitization of input. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, no user interaction, and scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. There is no vendor advisory or patch available at this time.

An attacker can exploit this SQL Injection vulnerability to access sensitive data (high confidentiality impact) and cause a partial denial of service (low availability impact). The vulnerability does not affect data integrity. Exploitation requires low privileges and no user interaction, increasing risk. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting network access to the affected service and monitoring for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable versions publicly if possible.