CVE-2025-12139

File Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure

2025-11-04 17:38
ifoundbug

Strategic Overview

Status
Patched in 1.5.4
Affected Plugin
File Manager for Google Drive – Integrate Google Drive
Affected Version
<= 1.5.3
CVSS
7.5High
Weakness type
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
CVE
CVE-2025-12139
View all File Manager for Google Drive – Integrate Google Drive vulnerabilities

At a glance

CVE-2025-12139 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the File Manager for Google Drive WordPress plugin, affecting versions <= 1.5.3. It carries a CVSS score of 7.5 (reachable over the network; low attack complexity; high confidentiality impact). Exploitation requires no authentication. The issue is fixed in version 1.5.4; sites on affected versions should update now. Disclosed November 2025, reported by ifoundbug.

Vulnerability Overview

The File Manager for Google Drive – Integrate Google Drive with WordPress plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.5.3 via the "get_localize_data" function. This makes it possible for unauthenticated attackers to extract sensitive data including Google OAuth credentials (client_id and client_secret) and Google account email addresses.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

File Manager for Google Drive <= 1.5.3 carries this weakness at get_localize_data, and reaching it takes no account at all. Sensitive information exposure means data the application intended to keep internal is returned to a caller who should not be able to see it.

The disclosed data — credentials, tokens, customer records or internal paths — is usually worth more as material for a follow-up attack than as an end in itself. For File Manager for Google Drive the fix is 1.5.4: builds <= 1.5.3 are affected, anything from 1.5.4 onward is not.

Remediation

Update to version 1.5.4, or a newer patched version

How does WordSec protect against this?

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: File Manager for Google Drive 1.5.4 closes this, and updating the plugin is the step that ends it.

  • Login Security
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2025-12139https://www.wordfence.com/threat-intel/vulnerabilities/id/607073ad-3a4a-4a21-af0f-3ade81382605https://nvd.nist.gov/vuln/detail/CVE-2025-12139

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C