CVE-2025-11174 Details

A vulnerability exists in the Document Library Lite plugin for WordPress, in all versions through 1.1.6, allowing improper authorization that leads to unauthorized access to sensitive information. The issue arises because the plugin exposes an unauthenticated AJAX action, 'dll_load_posts', which returns a JSON table of document data without requiring nonce or capability checks. This AJAX handler accepts an attacker-controlled 'args' array, where the 'status' option can be manipulated to include drafts, pending, future, and other statuses. As a result, unauthenticated attackers can exploit this endpoint to access unpublished document titles and content.

Users are advised to update the Document Library Lite plugin to version 1.1.7 or later.