The vulnerability exists in the deleteData function of the admin panel, where the selected_ids/ItemID parameter is improperly sanitized before being combined into a SQL statement. This omission allows an attacker to inject arbitrary SQL clauses. Provided that the admin panel is reachable from the internet, the injection can be executed remotely and could lead to disclosure of sensitive data, tampering with stored records, or escalation of privileges, depending on the underlying database permissions.

The affected product is PipraPay version 3.0.0, specifically the pp-content/pp-include/pp-functions.php file within the admin panel component. In the absence of a released fix, all installations of this version that expose the admin interface are vulnerable.

The CVSS score of 5.3 categorizes the flaw as moderate, and the EPSS score is currently unavailable, while the vulnerability is not yet listed in the CISA KEV catalog. Because the attack vector is remote and the exploit has been publicly disclosed, the risk of exploitation is non‑negligible. Without a vendor‑issued patch, systems remain exposed, and security teams should treat this as a high‑priority issue until remediation is applied.