CVE-2025-11174

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11174", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-29T18:05:00.817Z", "datePublished": "2025-11-01T01:47:40.902Z", "dateUpdated": "2026-04-08T16:43:41.484Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:41.484Z"}, "affected": [{"vendor": "barn2media", "product": "Document Library Lite", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6. This is due to the plugin exposing an unauthenticated AJAX action dll_load_posts which returns a JSON table of document data without performing nonce or capability checks. The handler accepts an attacker-controlled args array where the status option explicitly allows draft, pending, future, and any. This makes it possible for unauthenticated attackers to retrieve unpublished document titles and content via the AJAX endpoint."}], "title": "Document Library Lite <= 1.1.6 - Missing Authorization to Sensitive Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b73d48a-1f10-4e47-a18f-82a3103b72bd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/document-library-lite/tags/1.1.5/src/Table/Ajax_Handler.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/document-library-lite/tags/1.1.5/src/Table/Ajax_Handler.php#L32"}, {"url": "https://plugins.trac.wordpress.org/browser/document-library-lite/tags/1.1.5/src/Simple_Document_Library.php#L492"}, {"url": "https://plugins.trac.wordpress.org/changeset/3385033/document-library-lite/trunk/src/Table/Ajax_Handler.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-285 Improper Authorization", "cweId": "CWE-285", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Avraham Shemesh"}, {"lang": "en", "type": "finder", "value": "Kai Aizen"}], "timeline": [{"time": "2025-10-08T17:25:11.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-31T13:31:48.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-03T18:57:02.582348Z", "id": "CVE-2025-11174", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T18:57:14.666Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11174", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-03T18:57:02.582348Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T18:57:06.982Z"}}], "cna": {"title": "Document Library Lite <= 1.1.6 - Missing Authorization to Sensitive Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Avraham Shemesh"}, {"lang": "en", "type": "finder", "value": "Kai Aizen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "barn2media", "product": "Document Library Lite", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-08T17:25:11.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-31T13:31:48.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b73d48a-1f10-4e47-a18f-82a3103b72bd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/document-library-lite/tags/1.1.5/src/Table/Ajax_Handler.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/document-library-lite/tags/1.1.5/src/Table/Ajax_Handler.php#L32"}, {"url": "https://plugins.trac.wordpress.org/browser/document-library-lite/tags/1.1.5/src/Simple_Document_Library.php#L492"}, {"url": "https://plugins.trac.wordpress.org/changeset/3385033/document-library-lite/trunk/src/Table/Ajax_Handler.php"}], "descriptions": [{"lang": "en", "value": "The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6. This is due to the plugin exposing an unauthenticated AJAX action dll_load_posts which returns a JSON table of document data without performing nonce or capability checks. The handler accepts an attacker-controlled args array where the status option explicitly allows draft, pending, future, and any. This makes it possible for unauthenticated attackers to retrieve unpublished document titles and content via the AJAX endpoint."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:41.484Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11174", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:43:41.484Z", "dateReserved": "2025-09-29T18:05:00.817Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-01T01:47:40.902Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Document Library Lite", "vendor": "barn2media", "versions": [{"lessThanOrEqual": "1.1.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6. This is due to the plugin exposing an unauthenticated AJAX action dll_load_posts which returns a JSON table of document data without performing nonce or capability checks. The handler accepts an attacker-controlled args array where the status option explicitly allows draft, pending, future, and any. This makes it possible for unauthenticated attackers to retrieve unpublished document titles and content via the AJAX endpoint."}, {"lang": "es", "value": "El plugin Document Library Lite para WordPress es vulnerable a la Autorizaci\u00f3n Inadecuada en todas las versiones hasta la 1.1.6, inclusive. Esto se debe a que el plugin expone una acci\u00f3n AJAX no autenticada, dll_load_posts, que devuelve una tabla JSON de datos de documentos sin realizar comprobaciones de nonce o de capacidad. El manejador acepta un array de argumentos controlado por el atacante, donde la opci\u00f3n de estado permite expl\u00edcitamente borrador, pendiente, futuro y cualquiera. Esto hace posible que atacantes no autenticados recuperen t\u00edtulos y contenido de documentos no publicados a trav\u00e9s del endpoint AJAX."}], "id": "CVE-2025-11174", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11174", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-03T18:57:02.582348Z", "version": "2.0.3"}}]}, "published": "2025-11-01T02:15:31.847", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/document-library-lite/tags/1.1.5/src/Simple_Document_Library.php#L492"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/document-library-lite/tags/1.1.5/src/Table/Ajax_Handler.php#L23"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/document-library-lite/tags/1.1.5/src/Table/Ajax_Handler.php#L32"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3385033/document-library-lite/trunk/src/Table/Ajax_Handler.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b73d48a-1f10-4e47-a18f-82a3103b72bd?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T23:31:40.373176+00:00", "value": {"mitigation_remediation": ["Update the Document Library Lite plugin to a version released after 1.1.6, which incorporates the necessary authorization checks for the dll_load_posts action.", "If an upgrade is not immediately possible, modify the plugin's Ajax_Handler class to enforce a capability check, such as verifying that the current user has the \"read\" capability, before executing dll_load_posts.", "After applying a fix or blocking the endpoint, perform a quick scan for unauthorized AJAX calls to confirm that the vulnerability is no longer exploitable."], "summary": {"action": "Apply patch", "impact": "Unauthorized disclosure of unpublished document titles and content"}, "threat_synthesis": {"affected_systems": "All WordPress sites running the Document Library Lite plugin version 1.1.6 or earlier are vulnerable. The plugin is maintained by barn2media and serves as a file and document gallery for WordPress installations. Users should confirm the installed version and note that any release before 1.1.7 contains the issue.", "description_and_impact": "The Document Library Lite plugin for WordPress contains an Improper Authorization flaw that allows unauthenticated users to call the AJAX action dll_load_posts. Because this action skips nonce validation and capability checks, it returns a JSON table of document data that can include unpublished documents. The handler accepts a status argument that can be set to draft, pending, future, or any, meaning that attackers can retrieve the titles and contents of documents that have not been published. This flaw is categorized as CWE\u2011285.", "risk_and_exploitability": "The CVSS score of 5.3 places this vulnerability in the moderate range, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack vector is an unauthenticated AJAX request that requires no credentials, meaning anyone who can reach the site can trigger the vulnerability. While the impact is limited to information disclosure, it is still a concern for sites handling sensitive or confidential documents. The risk is moderate, mitigated by the low EPSS, but the flaw should be addressed promptly to prevent accidental or targeted data leakage."}}}}, "created": "2025-11-03T10:43:43.019625+00:00", "updated": "2026-04-27T23:45:15.880456+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}