This vulnerability (CVE-2026-96827) affects Melapress Admin Notices Manager versions up to 1.6.0 and is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). It allows an administrator with high privileges to perform SQL Injection attacks by exploiting improper input sanitization in the product. The CVSS 3.1 score is 7.6, indicating a high severity with network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. The attack requires administrator privileges, limiting the attack surface to trusted users with elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict administrator access to trusted personnel only and consider additional input validation or web application firewall rules to mitigate SQL injection risks.