PT-2025-15381 · WordPress · 3Dprint Lite

Jon Cagan + 1 · Published 2025-04-08 · Updated 2026-04-03 · CVE-2025-3428

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: 3DPrint Lite plugin for WordPress versions up to, and including, 2.1.3.6

Description: The issue allows unauthenticated attackers to perform SQL Injection via the coating text parameter due to insufficient escaping of user-supplied input and lack of preparation in the existing SQL query. This enables attackers to append additional SQL queries to existing ones, potentially extracting sensitive information from the database.

Recommendations: For versions up to, and including, 2.1.3.6, consider disabling the coating text parameter until a patch is available to prevent SQL Injection attacks. Restrict access to sensitive database information to minimize the risk of exploitation. Avoid using the coating text parameter in SQL queries until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-3428

Affected Products

3Dprint Lite

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-3428 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3428 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3249784%403dprint-lite&new=3249784%403dprint-lite&sfp_email=&sfph_mail= · Patch
• https://t.me/cvenotify/128352 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1909522827318899141 · Twitter Post
• https://twitter.com/_r00tuser/status/2039976873342742530 · Twitter Post
• https://twitter.com/CVEnew/status/1909528302622327276 · Twitter Post
• https://t.me/cvenotify/118166 · Telegram Post
• https://t.me/cvetracker/21082 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/eaac2a61-7be6-4936-82a0-21c3665fa436?source=cve · Note