The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be accessed on Web servers such as Apache.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| 3dprint Lite Plugin | — | Update 3dprint-lite plugin to version 1.9.1.5, or a newer patched version | May 15, 2025 | Sep 23, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub