Affected function in admin/delete_admin.php allows an attacker to supply arbitrary IDs to delete administrator accounts without any authentication checks. This bypasses the authentication layer, permitting remote exploitation of the system. The weakness corresponds to CWE‑287 and CWE‑306, and it can lead to loss of administrative control and potentially full system compromise.

The vulnerability exists in SourceCodester Online Food Ordering System version 1.0 and any earlier releases that include the unprotected delete_admin.php endpoint. It is not limited to a specific operating system or environment, as the flaw is in the application code itself. Administrators running this version of the software should verify whether the patch has been applied.

The CVSS score of 6.9 indicates a moderate to high severity. The exploit is disclosed publicly, and the attack can be performed remotely without local access. Although the EPSS score is not available, the public disclosure and the nature of the authentication bypass suggest a substantial risk if the vulnerable endpoint remains accessible. The flaw is not listed in the CISA KEV catalog, but the absence of KEV does not reduce its importance. Immediate remediation is recommended.