Sensitive Information Exposure in File Manager for Google Drive Plugin by WordPress

CVE-2025-12139

What is CVE-2025-12139?

The File Manager for Google Drive plugin for WordPress presents a vulnerability where unauthenticated attackers can exploit the 'get_localize_data' function. This issue affects all versions up to and including 1.5.3, allowing malicious actors to retrieve sensitive user data, including Google OAuth credentials (client_id and client_secret) and associated email addresses. Such exposure can lead to unauthorized account access and significant security breaches, necessitating immediate attention from users to secure their installations.

References