{"id":"CVE-2026-48200","kind":"vulnerability","aliases":["CVE-2026-48200"],"related":[],"title":"WordPress Document Library Lite plugin leaks sensitive data in responses","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0.","summary":"Document Library Lite, a WordPress plugin by Barn2, sends sensitive information embedded in its output. An attacker can retrieve that embedded sensitive data from the plugin's responses.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["barn2","document-library-lite","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Document Library Lite plugin (slug document-library-lite) is installed on the WordPress site.\n- Compare the installed plugin version against the affected range in the NVD entry (through 1.3.0).","fix":"- Move to a version later than `1.3.0` of Document Library Lite; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-29T16:18:09+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:31:50+00:00","updated_at":"2026-10-29T16:31:50+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T16:31:50Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version later than `1.3.0` of Document Library Lite; the exact fixed version is unknown from the sources.","reach":"internet","title":"WordPress Document Library Lite plugin leaks sensitive data in responses","impact":"medium","summary":"Document Library Lite, a WordPress plugin by Barn2, sends sensitive information embedded in its output. An attacker can retrieve that embedded sensitive data from the plugin's responses.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","document-library-lite","barn2"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker retrieves sensitive data embedded in plugin output","analyst_note":"Confirm the fixed version and which data is exposed and under what conditions, from the NVD entry or Barn2's advisory.","how_to_check":"- Check whether the Document Library Lite plugin (slug document-library-lite) is installed on the WordPress site.\n- Compare the installed plugin version against the affected range in the NVD entry (through 1.3.0).","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Document Library Lite WordPress plugin at version 1.3.0 or earlier are in the affected range. The sources do not describe the exact data path or configuration needed to reach the embedded data, so the exposure conditions are unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000688,"input_tokens":4121,"output_tokens":552,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-48200':13A,16A '1.3.0':83C 'affect':76C 'allow':70C 'attack':40B 'barn2':17B,31B,61C 'cve':11A,14A 'data':8A,46B,58C 'data.this':74C 'document':2A,19B,24B,63C,67C,77C 'document-library-lit':18B,66C 'embed':35B,44B,72C 'inform':34B,55C 'insert':52C 'issu':75C 'leak':6A 'librari':3A,20B,25B,64C,68C,78C 'lite':4A,21B,26B,65C,69C,79C 'n/a':81C 'output':38B 'packag':22B 'plugin':5A,29B,49B,62C 'respons':10A,51B 'retriev':42B,71C 'send':32B 'sensit':7A,33B,45B,54C,73C 'sent':57C 'vulner':59C 'wordpress':1A,23B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Document Library Lite WordPress plugin at version 1.3.0 or earlier are in the affected range. The sources do not describe the exact data path or configuration needed to reach the embedded data, so the exposure conditions are unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-48200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48200","severity":null,"published_at":"2026-10-29T16:18:09+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}