CVE-2025-3428
📋 TL;DR
The 3DPrint Lite WordPress plugin contains an SQL injection vulnerability in the 'coating_text' parameter that allows unauthenticated attackers to execute arbitrary SQL queries. This can lead to unauthorized access to sensitive database information. All WordPress sites using 3DPrint Lite version 2.1.3.6 or earlier are affected.
💻 Affected Systems
- 3DPrint Lite WordPress Plugin
📦 What is this software?
3dprint Lite by Wp3dprinting
⚠️ Risk & Real-World Impact
Worst Case
Attackers extract sensitive data including user credentials, personal information, and administrative access, potentially leading to complete site compromise.
Likely Case
Attackers extract database contents such as user emails, hashed passwords, and plugin configuration data.
If Mitigated
Limited information disclosure if database permissions are properly restricted and sensitive data is encrypted.
🎯 Exploit Status
SQL injection via GET/POST parameters requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.1.3.6
Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3249784%403dprint-lite&new=3249784%403dprint-lite&sfp_email=&sfph_mail=
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 3DPrint Lite and click 'Update Now'
4. Verify plugin version is greater than 2.1.3.6
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the vulnerable plugin until patched
wp plugin deactivate 3dprint-lite
Web Application Firewall Rule
allBlock requests containing SQL injection patterns targeting coating_text parameter
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in custom code
- Restrict database user permissions to SELECT only for the plugin's tables
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → 3DPrint Lite version numberCheck Version:
wp plugin get 3dprint-lite --field=versionVerify Fix Applied:
Confirm plugin version is greater than 2.1.3.6 and test coating_text parameter with SQL injection payloads📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in WordPress debug logs
- Multiple requests with SQL keywords in coating_text parameter
Network Indicators:
- HTTP requests containing SQL injection patterns in GET/POST parameters
SIEM Query:
source="wordpress.log" AND "coating_text" AND ("UNION" OR "SELECT" OR "INSERT" OR "DELETE")