CVE-2025-3429: Wp3dprinting 3dprint Lite SQLi Vulnerability

CVE-2025-3429 Overview

CVE-2025-3429 is a SQL Injection vulnerability [CWE-89] affecting the 3DPrint Lite plugin for WordPress. The flaw exists in the handling of the material_text parameter, which is not properly escaped before inclusion in an SQL query. All versions up to and including 2.1.3.6 are affected. An attacker with high privileges can append additional SQL statements to the existing query and extract sensitive information from the WordPress database. The vulnerability affects the confidentiality of stored data but does not permit modification or denial of service based on the assigned CVSS metrics.

Critical Impact

Attackers can extract sensitive database contents, including user credentials, session tokens, and administrative configuration, from any WordPress site running a vulnerable version of 3DPrint Lite.

Affected Products

• WordPress 3DPrint Lite plugin (wp3dprinting/3dprint_lite) versions through 2.1.3.6
• WordPress installations with the 3DPrint Lite plugin activated
• Any e-commerce or 3D printing workflow relying on this plugin for material selection

Discovery Timeline

• 2025-04-08 - CVE-2025-3429 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3429

Vulnerability Analysis

The vulnerability resides in the 3DPrint Lite plugin's handling of the material_text request parameter. The plugin concatenates the user-supplied value directly into an SQL query without prepared statements or adequate escaping. This design allows an attacker to break out of the intended query context and append arbitrary SQL clauses. The injected payload executes with the database privileges of the WordPress site, enabling read access to any table the plugin's database user can query, including wp_users and wp_usermeta.

Exploitation targets read operations, so the primary risk is data theft rather than data tampering. However, disclosed password hashes and session data can be leveraged for follow-on account takeover and privilege escalation attacks against the WordPress environment.

Root Cause

The root cause is insufficient input sanitization combined with the absence of parameterized queries in the plugin's database layer. The plugin trusts the material_text parameter and inserts it into a dynamically constructed SQL statement. Because WordPress exposes $wpdb->prepare() for safe query construction, the affected code path represents a deviation from documented secure coding practices for plugin developers.

Attack Vector

The attack is delivered over the network to the vulnerable WordPress endpoint that processes 3DPrint Lite requests. According to the CVSS vector, the attacker requires high privileges on the target site to reach the vulnerable code path, and no user interaction is needed. Once authenticated, the attacker submits a crafted material_text value containing SQL syntax such as UNION SELECT clauses to exfiltrate data from arbitrary tables. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-3429

Indicators of Compromise

• HTTP requests to 3DPrint Lite endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the material_text parameter
• Web server access logs showing unusually long or URL-encoded material_text values
• Database error entries referencing malformed SQL originating from the plugin's queries
• Unexpected outbound queries against wp_users, wp_usermeta, or wp_options tables

Detection Strategies

• Deploy web application firewall rules that inspect the material_text parameter for SQL metacharacters and common injection payloads
• Enable MySQL general query logging temporarily to identify anomalous queries originating from the plugin
• Correlate authenticated session activity with database read patterns to surface bulk data extraction attempts

Monitoring Recommendations

• Monitor WordPress admin and REST API endpoints for repeated failed requests to 3DPrint Lite handlers
• Alert on spikes in response size from plugin endpoints, which can indicate successful UNION-based data exfiltration
• Track privileged account activity for unusual query volume against sensitive tables

How to Mitigate CVE-2025-3429

Immediate Actions Required

• Upgrade the 3DPrint Lite plugin to a version later than 2.1.3.6 as soon as a patched release is available from the vendor
• Audit WordPress user accounts with high privileges and rotate credentials that may have been exposed through database reads
• Review WordPress access and database logs for signs of prior exploitation of the material_text parameter

Patch Information

The vendor addressed the issue in the plugin repository. Review the WordPress Plugin Changeset to confirm the fix is present in the deployed version. Additional advisory details are available in the Wordfence Vulnerability Report.

Workarounds

• Deactivate the 3DPrint Lite plugin until the patched version is installed
• Restrict access to the WordPress admin area and plugin endpoints using IP allowlists or network segmentation
• Apply virtual patching through a web application firewall to block SQL injection payloads targeting material_text
• Enforce least-privilege permissions on the WordPress database user to limit the scope of data accessible via injection

# Example WAF rule pattern to block SQLi payloads in the material_text parameter
# Adapt to your WAF syntax (ModSecurity example)
SecRule ARGS:material_text "@rx (?i)(union(\s|\+)+select|information_schema|sleep\s*\(|benchmark\s*\()" \
  "id:1003429,phase:2,deny,status:403,msg:'Potential SQLi in 3DPrint Lite material_text (CVE-2025-3429)'"