The vulnerability CVE-2026-92926 exists in code-projects Matrimonial System 1.0 within the writepartnerprefs function of /partner_preference.php. It allows remote attackers to perform SQL injection by manipulating the 'education' parameter. This can lead to unauthorized database queries or data manipulation. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit information has been disclosed, but there are no known active exploits in the wild. No official patch or fix details have been provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. Since the attack vector is remote and requires no privileges or user interaction, it poses a significant risk to the confidentiality and integrity of the affected system's data. However, the overall severity is medium, reflecting some limitations in impact or exploit complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and sanitization on the 'education' parameter to prevent SQL injection. Monitoring for unusual database queries and restricting database permissions may also help mitigate risk.