CVE-2026-5330: Improper Access Control in Best Courier Management System

Successful exploitation of CVE-2026-5330 allows an attacker to delete user accounts within the Best Courier Management System without proper authorization. This can disrupt operations, compromise sensitive data associated with those accounts (e.g., delivery information, contact details), and potentially grant the attacker administrative access if they delete a privileged user. The public availability of a proof-of-concept significantly increases the risk of widespread exploitation, particularly against systems with weak security configurations or those not actively monitored for intrusion attempts. The blast radius extends to all users of the affected system, as any user account could be targeted for deletion.

1. Reserved2026-04-01
2. Published2026-04-02
3. EPSS updated2026-04-10

The primary mitigation for CVE-2026-5330 is to upgrade to a patched version of Best Courier Management System. Since a fixed version is not specified, consider reverting to a previous, known-stable version if upgrading causes compatibility issues. As a temporary workaround, implement strict access controls on the /ajax.php?action=delete_user endpoint, requiring authentication and authorization checks before allowing user deletion. Web application firewalls (WAFs) can be configured to block requests with suspicious 'ID' parameter values. Monitor access logs for unusual deletion activity and implement intrusion detection systems (IDS) to alert on potential exploitation attempts.