PT-2025-45088 · WordPress · File Manager For Google Drive – Integrate Google Drive With Wordpress

Ifoundbug · Published 2025-11-05 · Updated 2025-12-24 · CVE-2025-12139

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions File Manager for Google Drive – Integrate Google Drive with WordPress versions prior to 1.5.4

Description The File Manager for Google Drive – Integrate Google Drive with WordPress plugin for WordPress has a flaw that allows unauthenticated attackers to extract sensitive data. This includes Google OAuth credentials (client id and client secret) and Google account email addresses. The issue is due to the "get localize data" function.

Recommendations Update File Manager for Google Drive – Integrate Google Drive with WordPress to a version later than 1.5.3.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-12139

Affected Products

File Manager For Google Drive – Integrate Google Drive With Wordpress

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-12139 · Security Note
• https://t.me/cveNotify/141771 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/607073ad-3a4a-4a21-af0f-3ade81382605?source=cve · Note
• https://plugins.trac.wordpress.org/browser/integrate-google-drive/tags/1.5.3/includes/class-enqueue.php#L88 · Note
• https://plugins.trac.wordpress.org/changeset/3387825/integrate-google-drive · Note
• https://plugins.trac.wordpress.org/browser/integrate-google-drive/tags/1.5.3/includes/class-enqueue.php#L232 · Note
• https://twitter.com/pdnuclei_bot/status/2003767644223406311 · Twitter Post
• https://twitter.com/MNovofastovsky/status/1988230583441355252 · Twitter Post
• https://t.me/CVEtracker/36595 · Telegram Post
• https://plugins.trac.wordpress.org/browser/integrate-google-drive/tags/1.5.3/includes/class-enqueue.php#L243 · Note
• https://twitter.com/TheExploitLab/status/2003069859144540306 · Twitter Post
• https://twitter.com/cracbot/status/1987837692244357169 · Twitter Post