The vulnerability is a classic SQL injection flaw in the 3DPrint Lite WordPress plugin. The ‘material_text’ parameter is incorporated into a SQL query without proper escaping or prepared statement usage, allowing an attacker to inject malicious SQL. Successful exploitation could enable retrieval of sensitive database content such as user credentials, plugin configuration, or other confidential data. This flaw aligns with CWE‑89.

The affected product is the 3DPrint Lite WordPress plugin, versions 2.1.3.6 and earlier, distributed by fuzzoid. All installations hosted on WordPress sites that have not upgraded beyond 2.1.3.6 are vulnerable. The plugin integrates directly with the WordPress database, so the impact is limited to sites where the plugin is active and accessible.

The CVSS score is 4.9, indicating moderate impact with limited attack surface. The EPSS score of less than 1% suggests an unlikely exploitation event under current conditions. The vulnerability is not listed in the CISA KEV catalog, further indicating low exposure to known exploitation. The attack vector is likely through a standard HTTP request containing a malicious ‘material_text’ value, which can be performed by unauthenticated users if the route is publicly exposed.