The EPSS of 0.00263 for CVE-2026-75089 tells you something important: automated exploitation is unlikely. The CVSS 7.3 tells you something else: if someone targets this specifically, the impact is genuine SQL injection with database exposure. Neither metric alone answers the question that matters for defenders: what do I actually do about a SQL injection in a niche PHP application that probably has no maintainer?
The SQL injection lives in check_availability.php — an AJAX validation endpoint that passes the email parameter directly into a query without parameterization. It's a textbook mistake, the kind static analysis tools catch in seconds, and not a vulnerability class that should surprise anyone who has reviewed PHP code written for coursework. The public exploit means your vulnerability scanners will flag it. That's where the practical problem starts, not ends.
The disconnect between CVSS and EPSS here reflects something structural: this is exactly the kind of forgotten deployment that EPSS models struggle to capture. PHPGurukul and similar educational codebases circulate beyond their intended lifespan — they land in student projects, get deployed by small businesses who found them via search, and sit in internal networks with no owner, no monitoring, and no patch path. The EPSS measures probability of targeted exploitation by sophisticated actors. It says nothing about opportunistic scanning or the long tail of unmaintained instances that automated exploit kits hit regardless of attacker sophistication.
For defenders, the actionable reality is this: if you find PHPGurukul in your asset inventory, treat it as you would any SQL injection — the severity rating is legitimate. But also check whether the instance is actively maintained. If the maintainer is a professor who moved on or a student who graduated, you're looking at abandoned infrastructure, not a patchable vulnerability. In that case, your response isn't scanning and patching — it's decommissioning or network isolation. The CVE serves as a useful artifact precisely because it documents where abandoned educational code creates exposure that organizations may not know exists on their network. The disclosure is less an actionable threat intelligence signal and more a historical record of the supply chain debt these codebases represent. Prioritize accordingly: patch what you can, isolate what you can't, and recognize that some vulnerabilities exist in software where the remediation window closed before the CVE was even published.