Improper Authorization Vulnerability in Document Library Lite for WordPress

CVE-2025-11174

What is CVE-2025-11174?

The Document Library Lite plugin for WordPress suffers from an Improper Authorization vulnerability found in all versions up to and including 1.1.6. This flaw is rooted in the plugin's implementation of the dll_load_posts unauthenticated AJAX action, which exposes document data without necessary nonce or capability validations. An attacker can manipulate the args array in this action, specifically the status option, allowing access to unpublished document titles and content. As a result, this can lead to unauthorized disclosure of sensitive information through the unrestricted AJAX endpoint.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References