CVE-2025-11174

The Document Library Lite plugin for WordPress contains a flaw in its authorization mechanism that affects all versions up to 1.1.6. Specifically, an attacker can exploit the dll_load_posts AJAX action by manipulating the args array's status option to bypass authentication checks. As a result, unauthenticated users can obtain unpublished document metadata through this vulnerable endpoint.

Based on public CVE data (MITRE/NVD).