The 3DPrint Lite plugin for WordPress contains a SQL Injection flaw due to insufficient escaping of the 'printer_text' parameter, as indicated by CWE-89. The official description states that attackers can append additional SQL statements to the existing query, allowing them to read sensitive data from the database. Although the CVE title references admin-level authentication, the description specifically notes that unauthenticated attackers could exploit this vulnerability, implying that the flaw is reachable without requiring elevated privileges.

The affected product is the 3DPrint Lite WordPress plugin from fuzzoid. All versions up to and including 2.1.3.6 are vulnerable. The plugin is distributed as a WordPress extension and interacts with the site database through the WordPress API.

The CVSS score of 4.9 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the WordPress admin interface where the printer_text parameter is processed. Unauthenticated attackers could trigger the injection simply by crafting requests that target the vulnerable function, while authenticated administrators could potentially exploit the flaw more easily if proper access controls are not enforced.