The Document Library Lite plugin for WordPress versions up to and including 1.1.6 contains an improper authorization vulnerability. This flaw allows unauthenticated attackers to access unpublished document titles and content through an exposed AJAX action that lacks nonce or capability checks. The vulnerability arises because the AJAX handler accepts attacker-controlled arguments that permit retrieval of draft, pending, future, and other non-public document statuses.