The vulnerability CVE-2026-7409 affects SourceCodester Pizzafy Ecommerce System 1.0. It is caused by improper sanitization in the save_user function of the /admin/ajax.php?action=save_user file, which allows an attacker with high privileges to perform SQL injection attacks remotely. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no user interaction, but requiring high privileges. The vulnerability has been publicly disclosed with an exploit published, but no official fix or patch is currently available.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or disruption of application functionality. However, exploitation requires high privileges, limiting the scope of potential attackers. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted users only and monitor for suspicious activity related to the save_user function. Avoid exposing the vulnerable endpoint to untrusted networks. Follow up with the vendor for updates on patches or mitigations.