The Document Library Lite plugin for WordPress contains an improper authorization vulnerability (CWE-285) in all versions up to and including 1.1.6. The vulnerability exists because the plugin exposes an unauthenticated AJAX action named dll_load_posts, which returns a JSON table of document data without verifying user permissions or nonce tokens. The handler accepts an attacker-controlled args array, where the status parameter can be set to draft, pending, future, or any, enabling attackers to access unpublished document titles and content through this endpoint. This vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There are no known exploits in the wild and no official patch or remediation information provided in the available data.

An unauthenticated attacker can retrieve unpublished document titles and content from the affected WordPress plugin, potentially exposing sensitive or confidential information that was not intended for public access. The vulnerability does not affect integrity or availability but compromises confidentiality of unpublished documents.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the vulnerable AJAX endpoint or limiting the plugin's use to trusted environments. Monitor vendor channels for updates and apply patches promptly once released.