The Document Library Lite plugin for WordPress contains an Improper Authorization flaw that allows unauthenticated users to call the AJAX action dll_load_posts. Because this action skips nonce validation and capability checks, it returns a JSON table of document data that can include unpublished documents. The handler accepts a status argument that can be set to draft, pending, future, or any, meaning that attackers can retrieve the titles and contents of documents that have not been published. This flaw is categorized as CWE‑285.

All WordPress sites running the Document Library Lite plugin version 1.1.6 or earlier are vulnerable. The plugin is maintained by barn2media and serves as a file and document gallery for WordPress installations. Users should confirm the installed version and note that any release before 1.1.7 contains the issue.

The CVSS score of 5.3 places this vulnerability in the moderate range, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack vector is an unauthenticated AJAX request that requires no credentials, meaning anyone who can reach the site can trigger the vulnerability. While the impact is limited to information disclosure, it is still a concern for sites handling sensitive or confidential documents. The risk is moderate, mitigated by the low EPSS, but the flaw should be addressed promptly to prevent accidental or targeted data leakage.