CVE-2025-12139

HIGH NUCLEI

Google Drive WordPress Plugin <1.5.3 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-12139. PoCs published by Galaxy-sc. A Nuclei detection template is also available.

AI-analyzed exploit summary This is a functional Go-based exploit for CVE-2025-12139, targeting an information disclosure vulnerability in the WordPress 'Integrate Google Drive' plugin (versions <= 1.5.3). The exploit extracts sensitive Google OAuth credentials and tokens from the 'igd' JavaScript variable exposed via wp_localize_script.

Description

The File Manager for Google Drive – Integrate Google Drive with WordPress plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.5.3 via the "get_localize_data" function. This makes it possible for unauthenticated attackers to extract sensitive data including Google OAuth credentials (client_id and client_secret) and Google account email addresses.

Exploits (1)

nomisec WORKING POC 1 stars
by Galaxy-sc · poc
https://github.com/Galaxy-sc/CVE-2025-12139-WordPress-Integrate-Google-Drive-Exploit

This is a functional Go-based exploit for CVE-2025-12139, targeting an information disclosure vulnerability in the WordPress 'Integrate Google Drive' plugin (versions <= 1.5.3). The exploit extracts sensitive Google OAuth credentials and tokens from the 'igd' JavaScript variable exposed via wp_localize_script.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: WordPress Plugin Integrate Google Drive <= 1.5.3
No auth needed
Prerequisites: Target must have the vulnerable plugin installed and active · The plugin must expose the 'igd' variable in the page source
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Integrate Google Drive <= 1.5.3 - Information Disclosure
HIGHVERIFIEDby Meysam Bal-afkan

References (5)

Core 5

Scores

CVSS v3 7.5
EPSS 0.1810
EPSS Percentile 95.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (1)
princeahmed/File Manager for Google Drive – Integrate Google Drive < 1.5.3
Published Nov 05, 2025
Tracked Since Feb 18, 2026