The 3DPrint Lite WordPress plugin is vulnerable to SQL Injection through its infill_text parameter. Insufficient input escaping and lack of prepared statements allow an attacker to append arbitrary SQL to the existing query. This flaw can be used to read or modify data stored in the WordPress database, potentially exposing confidential information or compromising site integrity.

All versions of the Fuzzoid 3DPrint Lite plugin for WordPress up to and including 2.1.3.6 are affected. Sites using any of these releases, regardless of other plugin configurations, are at risk.

With a CVSS score of 4.9 the flaw is rated low‑medium severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the flaw via the plugin’s infill_text interface, most likely through a web request; while the description suggests unauthenticated exploitation, the title indicates that administrator privileges may be required, so the exact requirements remain uncertain. If exploited, the attacker could retrieve sensitive data and alter site content.