The vulnerability resides in the Query Builder deleteBatch() method of CodeIgniter 4. From version 4.3.0 until 4.7.3 inclusive, SQL fragments provided by the user in where() condition bindings are substituted into the generated delete statement without respecting the framework's escape flags. This leads to uncontrolled SQL injection, allowing an attacker to inject arbitrary SQL into the delete command. The flaw is defined as CWE-89. The attacker can delete, modify, or read data beyond the intended rows, potentially compromising confidentiality, integrity, or availability of the database.

CodeIgniter 4.3.0 through 4.7.3. The affected product is CodeIgniter4, a PHP web framework maintained by the codeigniter4 organization. Applications built with these versions that use deleteBatch() with where() conditions are vulnerable.

This is a critical flaw with a CVSS score of 9.4. The EPSS score is <1%, indicating a very low likelihood of exploitation on a global scale. The vulnerability is not listed in the CISA Key Exploited Vulnerabilities catalog. Exploitation requires that an attacker can influence the parameters passed to deleteBatch(); based on the description, the attack vector is likely a web request that includes user‑controlled where() input. With sufficient privileges or without privileged database access, the attacker could execute arbitrary SQL commands through the unsafe substitution.