PT-2025-45088 · WordPress · File Manager For Google Drive – Integrate Google Drive With Wordpress

Ifoundbug · Publicado 2025-11-05 · Atualizado 2025-12-24 · CVE-2025-12139

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions File Manager for Google Drive – Integrate Google Drive with WordPress versions prior to 1.5.4

Description The File Manager for Google Drive – Integrate Google Drive with WordPress plugin for WordPress has a flaw that allows unauthenticated attackers to extract sensitive data. This includes Google OAuth credentials (client id and client secret) and Google account email addresses. The issue is due to the "get localize data" function.

Recommendations Update File Manager for Google Drive – Integrate Google Drive with WordPress to a version later than 1.5.3.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2025-12139

Produtos afetados

File Manager For Google Drive – Integrate Google Drive With Wordpress

Referências · 12

• https://t.me/cveNotify/141771 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/607073ad-3a4a-4a21-af0f-3ade81382605?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/integrate-google-drive/tags/1.5.3/includes/class-enqueue.php#L88 · Nota
• https://plugins.trac.wordpress.org/changeset/3387825/integrate-google-drive · Nota
• https://plugins.trac.wordpress.org/browser/integrate-google-drive/tags/1.5.3/includes/class-enqueue.php#L232 · Nota
• https://twitter.com/pdnuclei_bot/status/2003767644223406311 · Publicação no Twitter
• https://twitter.com/MNovofastovsky/status/1988230583441355252 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-12139 · Nota de Segurança
• https://t.me/CVEtracker/36595 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/integrate-google-drive/tags/1.5.3/includes/class-enqueue.php#L243 · Nota
• https://twitter.com/TheExploitLab/status/2003069859144540306 · Publicação no Twitter
• https://twitter.com/cracbot/status/1987837692244357169 · Publicação no Twitter