CVE-2026-48200

MediumCVSS 5.3

Published: 29/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

21th percentile - higher than 21% of all known CVEs

Summary

The Document Library Lite WordPress plugin in versions up to 1.3.0 allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. The issue affects versions from n/a through 1.3.0.

Risk Assessment

An attacker may access sensitive data embedded in application responses, potentially leading to leakage of internal organizational information.

Recommendation

Update the Document Library Lite plugin to a version newer than 1.3.0 and review what data is embedded in outgoing responses.

Other vulnerabilities in Document Library Lite

CVE-2025-11174Medium
The Document Library Lite plugin for WordPress in versions up to and including 1.1.6 is vulnerable to Improper Authorization. The plugin exposes an unauthenticated AJAX action dll_load_posts that returns document data as JSON without nonce or capability checks. The handler accepts an attacker-controlled args array allowing retrieval of unpublished document titles and content.

Original NVD description (English source)

Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS