CVE-2026-14713 is a SQL injection vulnerability affecting SourceCodester Pizzafy E-Commerce System 1.0. The issue exists in the /admin/ajax.php?action=confirm_order file where the ID parameter is not properly sanitized, enabling remote attackers to inject SQL commands. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity) and does not require privileges or user interaction to exploit. Although exploit code is publicly available, there is no evidence of active exploitation. No official patch or remediation level has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion. The vulnerability affects the confidentiality, integrity, and availability of the system at a low to medium level as per the CVSS vector. However, the absence of a vendor patch increases the risk until mitigations are applied.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the ID parameter in /admin/ajax.php?action=confirm_order to prevent SQL injection. Restricting access to the affected endpoint to trusted administrators and monitoring for suspicious activity may also reduce risk.