CVE-2026-76998 is a SQL injection vulnerability affecting SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in an unknown function within the /admin/ajax.php endpoint when the action parameter is set to delete_category. Manipulating the ID argument in this request enables an attacker to inject SQL commands remotely. The vulnerability has been publicly disclosed, but no vendor-provided fix or mitigation details are available at this time.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector with low complexity and no privileges or user interaction required, but limited confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected endpoint and validating or sanitizing inputs at the application level to reduce risk.