Improper Authorization Vulnerability in Document Library Lite for WordPress

CVE-2025-11174

What is CVE-2025-11174?

The Document Library Lite plugin for WordPress suffers from an Improper Authorization vulnerability found in all versions up to and including 1.1.6. This flaw is rooted in the plugin's implementation of the dll_load_posts unauthenticated AJAX action, which exposes document data without necessary nonce or capability validations. An attacker can manipulate the args array in this action, specifically the status option, allowing access to unpublished document titles and content. As a result, this can lead to unauthorized disclosure of sensitive information through the unrestricted AJAX endpoint.

References