CVE-2026-124625: PipraPay Admin Panel pp-functions.php deleteData sql injection
A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-include/pp-functions.php of the component Admin Panel. The manipulation of the argument selectedids/ItemID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs privileges sufficient to access the PipraPay Admin Panel and invoke the affected deleteData functionality. The attack can be initiated remotely and does not require user interaction.
Which deployments are known to be affected?
PipraPay version 3.0.0 is identified as affected. The vulnerable code is in pp-content/pp-include/pp-functions.php, in the Admin Panel's deleteData function.
Is exploit activity a practical concern?
Yes. A proof of concept is publicly disclosed, and the vulnerability information states that the exploit may be used.
What is the impact of successful exploitation?
Successful SQL injection can affect the confidentiality, integrity, and availability of the vulnerable application, each with low impact according to the supplied severity vector.