CVE-2025-12139

HIGHNuclei

File Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-12139 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

The File Manager for Google Drive – Integrate Google Drive with WordPress plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.5.3 via the "get_localize_data" function. This makes it possible for unauthenticated attackers to extract sensitive data including Google OAuth credentials (client_id and client_secret) and Google account email addresses.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 5, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

File Manager for Google Drive – Integrate Google Drive

Browse princeahmed / File Manager for Google Drive – Integrate Google Drive

Default status: unaffected

CVE ListThrough 1.5.3affected

Proofs of concept

1

Repository PoCs

GitHubGalaxy-sc/CVE-2025-12139-WordPress-Integrate-Google-Drive-ExploitRepository PoCby Galaxy-sc0Scanner3 files

18.5 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Go program that fetches a target URL, searches the page source for a 'var igd' JavaScript variable, and parses it to check for exposed Google OAuth credentials and account data. It reports whether sensitive data was found but does not perform any exploitation actions.

Backdoor review

No backdoor observed in reviewed code

The supplied Go source code and README implement a straightforward proof-of-concept for CVE-2025-12139. The program fetches a target URL, extracts a JavaScript variable with a regex, parses JSON, and prints any discovered Google OAuth credentials. No hidden network calls, persistence mechanisms, credential exfiltration to a third party, or unrelated payloads are present. The behavior is fully consistent with the stated information-disclosure exploit.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesGo
Target softwareWordPress Plugin Integrate Google Drive
Attack typesInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code only detects and reports the presence of exposed sensitive data; it does not perform any action to exploit the vulnerability such as using the credentials to access Google Drive or modify data. The README describes it as a 'Proof of Concept (PoC) exploit' but the code itself is a scanner.

CVE-2025-12139.go:1-134README.md:4

Requirements

  • Target URL must be provided via -u flagCVE-2025-12139.go:53-54
  • Target must have the Integrate Google Drive plugin active and exposing the 'igd' variable in page sourceCVE-2025-12139.go:78-84

Observed behavior

  • Fetches the target URL via HTTP GETCVE-2025-12139.go:66-67
  • Extracts the 'igd' JavaScript variable from the response body using a regexCVE-2025-12139.go:78-79
  • Parses the extracted JSON and checks for clientID, clientSecret, and Base64-encoded accounts dataCVE-2025-12139.go:89-127
  • Prints whether the target is vulnerable based on the presence of sensitive dataCVE-2025-12139.go:129-133
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Payload withheldThe only outbound connection is the intended exploit request to the victim WordPress site; no hardcoded attacker-controlled server is contacted.CVE-2025-12139.go:67
Credential Extraction
Payload withheldMatches the described CVE-2025-12139 information disclosure; extracted data is only printed to stdout, not exfiltrated elsewhere.CVE-2025-12139.go:99-121
Author Contact
Payload withheldDisplayed in the banner; no code uses this for communication or data exfiltration.CVE-2025-12139.go:47
Review boundaries

What the analysis did not establish

  • One non-text file (proof.PNG) is present but not included in the text evidence; its content cannot be analyzed.
  • The evidence packet reports complete_artifact_coverage: false, indicating not all files are represented, though all selected text files are complete.
  • One non-text media file (proof.PNG, 13837 bytes) was flagged as metadata-only and not analyzed; its content could theoretically contain hidden instructions, but the text-based PoC code itself shows no backdoor behavior.
  • The review covers only the supplied evidence packets; no runtime behavior or external dependencies were examined.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Nuclei templates

1
ProjectDiscoveryHIGHIntegrate Google Drive <= 1.5.3 - Information DisclosureCVSS 7.5

File Manager for Google Drive - Integrate Google Drive with WordPress plugin for WordPress <= 1.5.3 contains sensitive information exposure caused by improper protection of the get_localize_data function, letting unauthenticated attackers extract Google OAuth credentials and account email addresses, exploit requires no authentication.

Impact

Unauthenticated attackers can extract sensitive Google OAuth credentials and email addresses, risking account compromise and data theft.

Remediation

Update to a version later than 1.5.3 or the latest available version.

AuthorsMeysam Bal-afkan
Template tagscvecve2025wordpresswp-pluginexposuretokengoogle-drive
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Google: inurl:"/wp-content/plugins/integrate-google-drive"
https://wordpress.org/plugins/integrate-google-drive/ https://github.com/Galaxy-sc/CVE-2025-12139-WordPress-Integrate-Google-Drive-Exploit

Source: ProjectDiscovery

References

4